HardenedBSD/src 066598esys/kern kern_ktrace.c, sys/netinet if_ether.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+27-0tests/sys/netinet/arp.sh
+9-5sys/netinet/if_ether.c
+9-2sys/kern/kern_ktrace.c
+3-3usr.sbin/jls/jls.8
+4-2sys/sys/smr_types.h
+2-3sys/sys/atomic_san.h
+54-157 files not shown
+62-2213 files

HardenedBSD/src fe830b0sys/kern kern_ktrace.c, sys/netinet if_ether.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+27-0tests/sys/netinet/arp.sh
+9-5sys/netinet/if_ether.c
+9-2sys/kern/kern_ktrace.c
+3-3usr.sbin/jls/jls.8
+4-2sys/sys/smr_types.h
+2-3sys/sys/atomic_san.h
+54-157 files not shown
+62-2213 files

HardenedBSD/src 492c5a1share/man/man9 namei.9, sys/fs/fuse fuse_vnops.c

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+2-36tests/sys/fs/fusefs/open.cc
+30-0tests/sys/fs/fusefs/nfs.cc
+2-25tests/sys/fs/fusefs/opendir.cc
+15-4share/man/man9/namei.9
+8-9sys/fs/fuse/fuse_vnops.c
+6-9tests/sys/fs/fusefs/mockfs.cc
+63-8322 files not shown
+129-12528 files

HardenedBSD/src caaeab6lib/libsecureboot/openpgp opgp_sig.c

libsecureboot: Report failure for unsupported hash algorithm

Reviewed by:    sjg
Pull request:   https://github.com/freebsd/freebsd-src/pull/1574
DeltaFile
+1-0lib/libsecureboot/openpgp/opgp_sig.c
+1-01 files

HardenedBSD/src 3dc0144lib/libc/tests/nss getgr_test.c getpw_test.c

Fix lib/libc/nss/getgr_test with large numbers of groups

These tests create a linked list with one entry for every group on the
running system.  On a system with about 30,000 groups, the test took 69
seconds to run, and crashed Kyua with the below error:

kyua: E: string or blob too big (sqlite op: sqlite3_bind_blob) (sqlite db: /root/.kyua/store/results.usr_tests.20241231-203317-570235.db).

Fix the test by limiting it to operating on the first 1024 groups.
Apply the same change to getpw_test and getserv_test too, which are
vulnerable to the same problem.

Sponsored by:   ConnectWise
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D48275

(cherry picked from commit d11904b350214943dedb64c7121d4602799d7afd)
DeltaFile
+4-0lib/libc/tests/nss/getgr_test.c
+4-0lib/libc/tests/nss/getpw_test.c
+4-0lib/libc/tests/nss/getserv_test.c
+12-03 files

HardenedBSD/src 09df42ftests/sys/fs/fusefs lseek.cc

fusefs: Coverity cleanup in the lseek tests

Always check the return value of open().

Reported by:    Coverity Scan
CID:            1471118 1471133 1471215 1471896 1471901 1472116 1473799
CID:            1473879 1473996 1555269 1558044
Sponsored by:   ConnectWise

(cherry picked from commit f415b2ef30f7bf0db753f09fbba7b0910475b0d2)
DeltaFile
+11-0tests/sys/fs/fusefs/lseek.cc
+11-01 files

HardenedBSD/src 8b2b77ctests/sys/fs/fusefs allow_other.cc forget.cc

fusefs: minor cleanup in the tests

Delete some unused includes and member variables.

Sponsored by:   ConnectWise

(cherry picked from commit c2153a533ffb9691848a072c7628dcf56e0e6442)
DeltaFile
+0-3tests/sys/fs/fusefs/allow_other.cc
+0-1tests/sys/fs/fusefs/forget.cc
+0-1tests/sys/fs/fusefs/io.cc
+0-1tests/sys/fs/fusefs/notify.cc
+0-64 files

HardenedBSD/src 60311a5sys/fs/fuse fuse_vfsops.c, tests/sys/fs/fusefs nfs.cc

fusefs: fix a memory leak

Fix a leak of a fuse_ticket structure.  The leak mostly affected
NFS-exported fuse file systems, and was triggered by a failure during
FUSE_LOOKUP.

Sponsored by:   ConnectWise

(cherry picked from commit 969d1aa4dbfcbccd8de965f7761203208bf04e46)
DeltaFile
+30-0tests/sys/fs/fusefs/nfs.cc
+1-1sys/fs/fuse/fuse_vfsops.c
+31-12 files

HardenedBSD/src d2c25c4sys/fs/fuse fuse_vnops.c fuse_file.c, tests/sys/fs/fusefs open.cc opendir.cc

fusefs: ignore FUSE_NO_OPEN(DIR)_SUPPORT flags

The FUSE_NO_OPEN_SUPPORT and FUSE_NO_OPENDIR_SUPPORT flags
are only meant to indicate kernel features, and should be ignored
if they appear in the FUSE_INIT reply flags.

Also fix the corresponding test cases.

Reviewed by:    Alan Somers <asomers at FreeBSD.org>
Signed-off-by:  CismonX <admin at cismon.net>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1509

(cherry picked from commit f0f596bd955e5b48c55db502e79fc652ac8970d3)
DeltaFile
+2-36tests/sys/fs/fusefs/open.cc
+2-25tests/sys/fs/fusefs/opendir.cc
+8-9sys/fs/fuse/fuse_vnops.c
+3-6sys/fs/fuse/fuse_file.c
+0-4sys/fs/fuse/fuse_internal.c
+0-2sys/fs/fuse/fuse_ipc.h
+15-826 files

HardenedBSD/src fb4e032tests/sys/fs/fusefs Makefile

fusefs: delete a comment in the tests

Even on a riscv embedded system, the fusefs tests run fast enough that
10 seconds is a reasonable timeout.

[skip ci]

Sponsored by:   ConnectWise

(cherry picked from commit 53f73aaffddaedff019555679d686ec401330d39)
DeltaFile
+0-1tests/sys/fs/fusefs/Makefile
+0-11 files

HardenedBSD/src b034811tests/sys/fs/fusefs mockfs.cc mockfs.hh

fusefs: More accurately test the unique tokens in the test suite

Every fuse ticket has a "unique" token.  As the name implies, they're
supposed to be unique.  Previously the fusefs test suite verified their
uniqueness by relying on the fact that they are also sequential.  But
they aren't guaranteed to be sequential.  Enhance the tests by removing
that convenient assumption.

Sponsored by:   Axcient

(cherry picked from commit b1879975794772ee51f0b4865753364c7d7626c3)
DeltaFile
+6-9tests/sys/fs/fusefs/mockfs.cc
+4-2tests/sys/fs/fusefs/mockfs.hh
+10-112 files

HardenedBSD/src 4f4b2b7sys/kern vfs_bio.c

boottrace: Don't say we've unmounted if we haven't.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    imp, markj
Differential Revision:  https://reviews.freebsd.org/D48515
DeltaFile
+1-1sys/kern/vfs_bio.c
+1-11 files

HardenedBSD/src 8874941share/man/man9 namei.9

namei: add more detail about LOCKSHARED's behavior

[skip ci]

Sponsored by:   ConnectWise
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D48125

(cherry picked from commit 22bb70a6b3bb7799276ab480e40665b7d6e4ce25)
DeltaFile
+15-4share/man/man9/namei.9
+15-41 files

HardenedBSD/src b797d07sys/fs/fuse fuse_device.c

fusefs: FUSE_NOTIFY_INVAL_* must busy the mountpoint

Unusually, the FUSE_NOTIFY_INVAL_INODE and FUSE_NOTIFY_INVAL_ENTRY
messages are fully asynchronous.  The server sends them to the kernel
unsolicited.  That means that unlike every other fuse message coming
from the server, these two arrive to a potentially unbusied mountpoint.
So they must explicitly busy it.  Otherwise a page fault could result if
the mountpoint were being unmounted.

Reported by:    JSML4ThWwBID69YC at protonmail.com

(cherry picked from commit 989998529387b4d98dfaa6c499ad88b006f78de8)
DeltaFile
+8-1sys/fs/fuse/fuse_device.c
+8-11 files

HardenedBSD/src 980eedbsys/netpfil/pf pf.c

pf: avoid use-after-free on reassembly

Ensure we update the mbuf pointer returned by pf_normalize_ip() or
pf_normalize_ip6() even if they fail.
Otherwise we'd risk using a freed mbuf.

PR:             283705
Reported by:    Yichen Chai <yichen.chai at gmail.com>, Zhuo Ying Jiang Li <zyj20 at cl.cam.ac.uk>
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 5d28f4cab8d5919aba1365e885a91a96c0655b59)
DeltaFile
+9-0sys/netpfil/pf/pf.c
+9-01 files

HardenedBSD/src 23b2704tests/sys/cam/ctl ctl.subr

Make the CTL tests more resilient

Fix the find_device function to work regardless of whether "camcontrol
devlist" lists the da device first and the pass device second or vice
versa.  On FreeBSD 14 and 15 it apparently always lists da first.  But
on 13 it can do it in either order.

Sponsored by:   ConnectWise
Reviewed by:    emaste, markj, #cam
Differential Revision: https://reviews.freebsd.org/D47446

(cherry picked from commit b032be711c740d2f25b27c92069537edcfac221c)
DeltaFile
+8-1tests/sys/cam/ctl/ctl.subr
+8-11 files

HardenedBSD/src 6203d08share/man/man4 ktls.4

ktls.4: note that security/gnutls now supports ktls

[skip ci]

PR:             278083
Sponsored by:   ConnectWise
Reviewed by:    diizzy
Differential Revision: https://reviews.freebsd.org/D47310

(cherry picked from commit 7200d90644ba61d63e6fec33855bba5d3b7eb7bd)

ktls.4: note that there are multiple openssl ports with KTLS knobs

[skip ci]

Reported by:    "Herbert J. Skuhra" <herbert at gojira.at>
Sponsored by:   ConnectWise

(cherry picked from commit 1e4da42a36d5cf44bacf0e261626b69a4761f0cc)
DeltaFile
+5-3share/man/man4/ktls.4
+5-31 files

HardenedBSD/src 4ea1574sys/fs/tmpfs tmpfs_vnops.c

tmpfs: remove duplicate flags check in tmpfs_rmdir

Reviewed By:    asomers
Differential Revision: https://reviews.freebsd.org/D47100

(cherry picked from commit ec22e705c266ff629cc5ec47b84f67ba02b7b924)
DeltaFile
+1-7sys/fs/tmpfs/tmpfs_vnops.c
+1-71 files

HardenedBSD/src 62af5b9sys/compat/linuxkpi/common/include/linux seqlock.h, sys/sys seqc.h atomic_san.h

atomics: Constify loads: Remove now superfluous uses of DECONST()

No functional change (intended).

Reviewed by:    kib
MFC after:      4 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D48497
DeltaFile
+2-2sys/sys/seqc.h
+1-2sys/sys/atomic_san.h
+1-1sys/compat/linuxkpi/common/include/linux/seqlock.h
+4-53 files

HardenedBSD/src c57c02esys/sys smr_types.h

smr: Load to accept pointers to const pointers

Pointers passed to the smr_entered_load() and smr_serialized_load()
macros are in the end used as arguments to atomic_load_*ptr(), so
convert them to the now acceptable 'const uintptr_t *' ones (instead of
'uintptr_tr *'), making these macros accept pointers to constant
pointers.

Reviewed by:    kib
MFC after:      4 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D48497
DeltaFile
+4-2sys/sys/smr_types.h
+4-21 files

HardenedBSD/src d0cbb19sys/sys atomic_common.h atomic_san.h

atomics: atomic_load_consume_ptr(): Accept pointers to const

Now that all directly-implemented loads (with acquire semantics or not)
accept pointers to const, ensure that atomic_load_consume_ptr(), built
on atomic_load_acq_ptr(), does so too, in the common atomics header as
well as *SAN interceptors.

Reviewed by:    kib
Fixes:          5e9a82e898d5 ("atomics: Constify loads")
MFC after:      4 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D48497
DeltaFile
+1-1sys/sys/atomic_common.h
+1-1sys/sys/atomic_san.h
+2-22 files

HardenedBSD/src ac2156csys/riscv/include atomic.h

atomics: Constify loads: riscv: Convert missed atomic_load_acq_64()

Reviewed by:    kib
Fixes:          5e9a82e898d5 ("atomics: Constify loads")
MFC after:      4 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D48497
DeltaFile
+1-1sys/riscv/include/atomic.h
+1-11 files

HardenedBSD/src 61c5090lib/libc/sys munmap.2

munmap.2: Unaligned addresses do not return error

We previously claimed that non-page-aligned addresses would return
EINVAL, but the address is in fact rounded down to the page boundary.

Reported by:    Harald Eilertsen <haraldei at anduin.net>
Reviewed by:    brooks
Sponsored by:   The FreeBSD Foundation
Fixes: dabee6fecc67 ("kern_descrip.c: add fdshare()/fdcopy()")
Differential Revision: https://reviews.freebsd.org/D48465

(cherry picked from commit 9e36aaf0c24cf158e83c69c1d2312c000c3c36f3)
DeltaFile
+1-4lib/libc/sys/munmap.2
+1-41 files

HardenedBSD/src e2cbfa1lib/libc/sys munmap.2

munmap.2: Remove EINVAL for negative len

len is unsigned (it is size_t), so cannot be negative.

Sponsored by:   The FreeBSD Foundation

(cherry picked from commit fab411c4fd5224e3dd44e0eb288d60b27480e2d1)
DeltaFile
+1-1lib/libc/sys/munmap.2
+1-11 files

HardenedBSD/src 0bfbd30usr.sbin/bsnmpd/tools/libbsnmptools bsnmptools.c

libbsnmptools: avoid uninitialized snmptoolctx->passwd with empty password

The removed check left snmptoolctx->passwd pointer to uninitialized
memory.  Always calling strlcpy(3) would guarantee that with empty
password it will point to empty string.

Submitted by:   markj
PR:             283909

(cherry picked from commit 3999a860d6e899de98b1025317d2d0ef1f83255f)
DeltaFile
+1-2usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c
+1-21 files

HardenedBSD/src c4cae8ccontrib/bsnmp/lib snmpclient.c

libbsnmp: avoid division by zero with empty password

PR:             283909
(cherry picked from commit 4dc1820a16b9b6108e0ff8a0265c08c67fa34146)
DeltaFile
+1-1contrib/bsnmp/lib/snmpclient.c
+1-11 files

HardenedBSD/src f909770. Makefile.inc1

pkgbase: Fix OSVERSION specification when creating a repo

-o OSVERSION= needs to appear before the "repo" verb, otherwise it has
no effect.  In this case, recent pkg-devel fails to create the repo,
saying that ABI cannot be specified without OSVERSION.

Reviewed by:    kevans, manu
MFC after:      2 weeks
Fixes:          188fe88ec50e ("pkgbase: force OSVERSION")
Differential Revision:  https://reviews.freebsd.org/D48518
DeltaFile
+1-1Makefile.inc1
+1-11 files

HardenedBSD/src 5b86888sys/kern kern_ktrace.c

ktrace: Fix uninitialized memory disclosure

The sockaddr passed to ktrcapfail() may be smaller than
sizeof(struct sockaddr), and the trailing bytes in the sockaddr
structure will be uninitialized, whereupon they get copied out to
userspace.

PR:             283673
Reviewed by:    jfree, emaste
Reported by:    Yichen Chai <yichen.chai at gmail.com>
Reported by:    Zhuo Ying Jiang Li <zyj20 at cl.cam.ac.uk>
Fixes:          9bec84131215 ("ktrace: Record detailed ECAPMODE violations")
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D48499
DeltaFile
+9-2sys/kern/kern_ktrace.c
+9-21 files

HardenedBSD/src b4bd97etests/sys/netinet arp.sh

netinet tests: basic garp test

Excercise the garp code.
This doesn't actively verify anything, but is sufficient to trigger the
panic reported in PR 284073, so it's a useful test case to keep.

PR:             284073
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+27-0tests/sys/netinet/arp.sh
+27-01 files

HardenedBSD/src 38fdccasys/netinet if_ether.c

netinet: enter epoch in garp_rexmit()

garp_rexmit() is a callback, so is not in net_epoch, which
arprequest_internal() expects.
Enter and exit the net_epoch.

PR:             284073
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+3-0sys/netinet/if_ether.c
+3-01 files