ktls: Propagate EPG_FLAG_ANON to mapped mbufs
Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.
PR: 296498
Fixes: 3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57557
(cherry picked from commit 815976ee14121bafe8a8ab002459d32f8928f2de)
ifnet: Restore previous size of if_afdata
Struct ifnet contains an array if_afdata of AF_MAX pointers to address
information for each possible address family. Since 2013, when AF_MAX
was inadvertently changed to be equal to the highest possible value,
instead of one more than the highest possible value, this array has been
too small in theory, but this never mattered in practice because the
higher address families were not assignable to interfaces.
My recent commit which corrected the value of AF_MAX had the side effect
of breaking the KBI by changing the size and layout of struct ifnet.
This manifested itself as kernel panics when using third-party network
drivers and went unnoticed in main because if_afdata no longer exists
there. Address the issue for stable/15 and stable/14 by keeping the
correct value of AF_MAX but deliberately making if_afdata off by one,
restoring its previous size.
Fixes: ddd850aa7720 ("sys/socket.h: Fix AF_MAX")
Sponsored by: Klara, Inc.
[3 lines not shown]
libifconfig: Fix table size
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa7720 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D58827
(cherry picked from commit 79a6ad63e6afdfa00d0e625996bddf91e9f217c3)
routing: Fix table sizes
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa7720 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: pouria, kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58826
(cherry picked from commit 6c41d928bcd763ec60d55bec2886c05b03cf9e6a)
sys/socket.h: Fix AF_MAX
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
(cherry picked from commit ddd850aa7720f77b6605599655df898b16ed74cc)
ure: add USB device IDs for additional RTL8152/RTL8153 adapters
Add device IDs for several USB Ethernet adapters that use
RTL8152 and RTL8153 chips but are not yet recognized by ure(4).
This includes adapters from Cisco/Linksys, D-Link, Lenovo,
Microsoft Surface, Realtek, Samsung, and TP-Link.
All added devices use chip revisions already handled by
ure_read_chipver().
Signed-off-by: Christos Longros <chris.longros at gmail.com>
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D55748
ure(4): Fix spurious link flaps from MII
A race condition in the MII layer causes spurious link down events.
In `statchg`, on link down, check if the PHY reports the link as
actually down using the BMSR register, if not, force the status of the
link to back up and restart TX. Do the same in a MII `linkchg` handler.
On actual link up, restart TX in case it went idle and down.
PR: 252165
Signed-off-by: Rafael Kitover <rkitover at gmail.com>
Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D55682
igc: additionally disable PCIe ASPM for I226
Always disable PCIe ASPM for i226 type cards to improve stability
and wire sysctl calls to iflib_request_reset instead of igc_if_init
as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5fbae2483e88805559881b04ccf9a80)
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[9 lines not shown]
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
