libbsdconf: parse from a bounded in-memory buffer
Copy the descriptor into a buffer of at most 64 MiB (raise it with
BSDCONF_MAX_BYTES) and tokenize with bsdconf_scan(), the walker
bsdconf_put() already uses. Input above the cap fails with EFBIG.
Bump libbsdconf to 1.2.0 and sysconf(8) to 2.0.
Suggested by: fuz
Reviewed by: fuz
Differential Revision: https://reviews.freebsd.org/D59751
bsnmp: validate the lower bound of error_index in responses
Check if the response's error_index is within a sane interval.
Otherwise, a rogue peer could crash us.
PR: 298222
Reported by: Robert Morris
Reviewed by: markj
Discussed with: secteam (markj)
MFC after: 2 weeks
Analyzed with: Claude Code Opus 5
route/fib_algo: Respect immediate_sync in fd_ref_nhop
Now fd_ref_nhop() returns zero for cross family routes,
Do not schedule nhop references and try to rebuild it immediately
for connected and static routes.
PR: 298733
Fixes: 633438224304 ("route/fib_algo: Fix nexthop index ...")
route/fib_algo: Remove redundant zeroing of fd_af
fd is allocated with M_ZERO and fd_num_af never decreases.
Therefore, no need for zeroing nhaf_count and nhaf_base here.
Fixes: 633438224304 ("route/fib_algo: Fix nexthop index ...")
aq.4: Remove experimental note
I added the text when this driver was merely an import of
https://github.com/Aquantia/aqtion-freebsd with patches from ports applied.
nprice@ resolved issues and added support for newer cards and the note is
no longer applicable.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59909
sound: Retire the version constants
They exist only to fill in MODULE_DEPEND() and MODULE_VERSION(), and
every consumer passed the same value for all three, so the version
range never did anything. Use 1, like the rest of the tree does.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: kib, emaste
Differential Revision: https://reviews.freebsd.org/D59873
libc: Parenthesise qualifier-preserving function definitions
Required to prevent function-like macros with the same name from
being expanded in the definitions once they become active in a
later C mode. Without the parentheses, the macro would rewrite
the declarator, and the file would consequently fail to compile.
This style is already used for similar cases such as mempcpy().
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59600
(cherry picked from commit c389738f21c09931cd88a84a357be514b5c60030)
libc: Implement bsearch_s(), document bsearch_b(), and add unit tests
- Implement bsearch_s() as per §K.3.6.3.2 in C23, first specified
in C11. It behaves identically to bsearch(), except the callback
is called with a third argument, context, which is passed through
from the caller, and it also performs runtime constraint checking
on its arguments.
- Document bsearch_b(), bsearch_s(), and add history section
- Add rudimentary unit tests for bsearch(), bsearch_b(), and bsearch_s()
Reviewed by: dteske, fuz
Approved by: dteske (mentor), fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58876
(cherry picked from commit d59c7ea2701fe7b73b32eef49a7c712ef38de5a0)
libc: Implement qualifier-preserving standard library functions
Several standard library functions are specified to return an unqualified
pointer while accepting a pointer to a potentially const-qualified object.
N3020 addresses this behaviour, discarding qualifiers due to incompatible
pointer types, by introducing qualifier-preserving macros for the affected
set of standard library functions.
Add `__qualsel()` helper to `<sys/cdefs.h>`, implemented using the generic
selection, and define qualifier-preserving macros for that set of functions
in `<string.h>`, `<wchar.h>`, and `<stdlib.h>`.
Macros are gated on `_STDC_VERSION__ >= 202311L && !__cplusplus`, therefore
there is no behavioural change for earlier C modes or C++ translation units.
The kernel is likewise unaffected, as it does not include userland headers.
As function-like macros, they are transparent except at a call site where
the address-of operator is applied, the macro is suppressed via `#undef`,
or the identifier appears in parenthesised form; all of which cause the
[8 lines not shown]
ntb_tool: Bound memory window option strings
parse_mw_buf() copies option names from privileged sysctl input into
eight-byte stack buffers. Unbounded %s conversions permit option tokens
longer than seven bytes to write past those buffers before the parser
validates them.
Limit each conversion to seven characters, leaving space for the
terminating NUL.
Signed-off-by: Yudi Yang <yudi.yang at rice.edu>
Fixes: 96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.")
Reviewed by: markj
MFC after: 1 week
(cherry picked from commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6)
amd64/pmap: Return la57 in amd nested page
AMD doesn't encode page depth in eptp. As a result, the page level is
decided by the host la57 value. Without this, it uses 4 level page and
therefore cause machine enable la57 have garbage page translation.
PR: 291768
Reviewed by: kib
Tested by: Antranig Vartanian <antranigv at freebsd.am>
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57978
(cherry picked from commit ef26f64c11220ea303de16d088c585f9d2908b0f)
buf: Avoid calling bufdomain() on newly initialized bufs
bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at
which point they haven't yet been assigned a domain. Thus, bufdomain()
returns &bdomain[-1], which trips the array-bounds sanitizer.
This is harmless since we don't use the result in that case, but let's
avoid the invalid access to begin with. This is sufficient to let an
amd64 kernel boot to a login prompt with -fsanitize=array-bounds
configured.
Reported by: Andrew Griffiths <andrew at calif.io>
Reviewed by: rlibby, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59381
(cherry picked from commit e1d903bbfaf91060c43209b35b78a9992fbffe5e)
Implement vmemdup_{array}_user
This is what FreeBSD now does for memdup_user and memdup_array_user
(which is wrong for memdup, but correct for vmemdup).
The amdgpu DRM driver started this in Linux ~6.12.86+
Reviewed by: wulf
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57444
(cherry picked from commit 302c6d25da6907ec762ff8937fa86d380743b000)
linuxkpi: Define `DEFINE_CLASS()` and `CLASS()`
`DEFINE_CLASS()` is in fact named `LINUXKPI_DEFINE_CLASS()` because it
conflicts with `DEFINE_CLASS()` defined in <sys/kobj.h>.
This macro defines a type and a pair of constructor/destructor
functions.
They are to be used by `CLASS()`: this one declares a variable,
initialise it with the constructor and set the `__cleanup()` attribute
to call the destructor once the variable goes out of scope.
The DRM drivers generic code started to use `CLASS()` in Linux 6.13. It
requires the `fd` class to be defined in <linux/file.h>.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57583
(cherry picked from commit f2a2e02ae54b836d1e23648756a050406f65111e)
amd64: add userspace control for disabling splitlocks
Thread can control it with sysarch(I386_SET_SPLITLOCK). The global
default is set with hw.splitlock_force.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
amd64: use WRMSRNS immediate form to update splitlock control, when available
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
