FreeBSD git weekly: 2026-04-20 to 2026-04-26

Reviewed by:  imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55461

`pfctl -A`, `-N`, `-O`, and `-R` restrict which rule types and options
are loaded. The man page language ("Load only...") does not make it
clear that these options can be combined to (re)load multiple rule types
and/or options without reloading the entire packet filter.

Add language to make it explicitly clear that these flags combine.

Reviewed by:    kp
Signed-off-by:  Ross Williams <ross@ross-williams.net>

Reviewed by:  markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

The gpart manual says that sizes are specified in blocks, unless an SI
unit suffix is provided. This confuses new operators because GEOM uses
binary bytes, a large difference at modern storage pool sizes. Rewrite
suffixes in all GEOM manuals to consistently clarify this, matching what
we and the rest of the industry have been doing in other documentation.
While here, use non-breaking spaces between numbers and units, unless
they are already written with a hyphen.

MFC after:              3 days
Reviewed by:            fuz
Reported by:            bbaovanc <bbaovanc@bbaovanc.com>
Differential Revision:  https://reviews.freebsd.org/D56534

Some targets override the default value of DISTRIBUTIONS.
Document that in the manual page.

Reported by:    Nia Alarie <nia@NetBSD.org>
Reviewed by:    jlduran
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56528

Last time I generated this, there were many copies of WITH_CASPER for
reasons unknown.

Sponsored by:           Netflix

If soreserve() or sosetopt() (to set TCP_NODELAY) fails after claiming
the socket from the file descriptor, explicitly close the socket
before returning failure.

Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D55493

AMD64 Architecture Programmer's Manual Volume 3 says the following:

> ECX[15:0] contains a count of the number of sequential pages to
> invalidate in addition to the original virtual address, starting from
> the virtual address specified in rAX. A count of 0 invalidates a
> single page. ECX[31]=0 indicates to increment the virtual address at
> the 4K boundary. ECX[31]=1 indicates to increment the virtual address
> at the 2M boundary. The maximum count supported is reported in
> CPUID function 8000_0008h, EDX[15:0].

ECX[31] being what we call INVLPGB_2M_CNT, signaling to increment the
VA by 2M.

> This instruction invalidates the TLB entry or entries, regardless of
> the page size (4 Kbytes, 2 Mbytes, 4 Mbytes, or 1 Gbyte). [...]

Combined with this, my interpretation of the current code is: if
<va> is aligned on a PDE boundary, we'll use INVLPGB_2M_CNT to try and
invalidate <cnt> PDEs with a single call, but that only works if <va> is
the start of at least <cnt> 2M pages.  Otherwise, if <va> or any of the
subsequent PDEs isn't actually a superpage, then we would actually only
invalidate the *first* page within the PDE before skipping to the next
PDE, leaving the remainder of the 4K pages in between as they were.

The implication would seem to be that we would need to inspect the range
that we're trying to invalidate if we're planning on using
INVLPGB_2M_CNT at all, so this patch just simplifies it to a series of
4K invalidations.  My gut feeling is that we likely still come out on
top vs. the TLB shootdown we're avoiding.

This seems to explain some issues we've seen lately with fdgrowtable()
and kqueue on recent Zen4/Zen5 EPYC hardware, where we'd experience
corruption that we can't explain.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293382
Reviewed by:    alc, kib, markj
Differential Revision:  https://reviews.freebsd.org/D56458

In addition to the locally generated statistics counters, dpaa2 ni
provides a larger set of counters than we currently export via
sysctl.  Add (most of) the missing counters and descriptions.
Around Page 3/4 there are some things left to do if we want.
Also the manual was not clear on the descriptions of 3/0 and 3/1.

The second half of the change adds another sysctl note which exports
the link-state, speed, and capabilities set as a text-blob.  This is
especially interesting in case the "ni" stops passing packets.
From what I have found in that case the (internal) link state of the
ni goes DOWN but we do not see an interrupt for a link-state change.

Being able to diagnose the state helps to (manually) fix it for now
by changing the media status to 10BaseT or none and then back to auto.
That usually brings the internal link state back UP.

MFC after:      3 days
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279352
Reviewed by:    dsl, tuexen
Differential Revision: https://reviews.freebsd.org/D55321

This change enables process-wide sampling to work with IBS by ensuring
that read/write only gets or sets the current counter.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2131

Add device IDs for several USB Ethernet adapters that use
RTL8152 and RTL8153 chips but are not yet recognized by ure(4).
This includes adapters from Cisco/Linksys, D-Link, Lenovo,
Microsoft Surface, Realtek, Samsung, and TP-Link.

All added devices use chip revisions already handled by
ure_read_chipver().

Signed-off-by: Christos Longros <chris.longros@gmail.com>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D55748

FreeBSD and NetBSD has copied these lines from the x86 architecture when
porting to other machines and forgetting to delete them.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2154

If we take an early goto out_unlocked inp is uninitialized and then
may be used in SCTP_LTRACE_ERR_RET().  Initialize inp to NULL
to avoid warnings.

Found with:     gcc15 tinderbox build
MFC after:      3 days
Reviewed by:    tuexen, pouria
Differential Revision: https://reviews.freebsd.org/D56503

pf assumes that interface names are unique (and share a namespace with
interface group names).
Unfortunately the FreeBSD network stack has a few edge cases where this
assumption can be violated. Try to be more robust against this: rather
than changing the association between a kif and ifp just ignore the next
interface with the same name.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

pf_udp_mapping_insert() may lock more than one row at a time.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cd5ff4e841fb ("pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes")
Reviewed by:    kp
Differential Revision:  https://reviews.freebsd.org/D56501

Signed-off-by:        Peter Ganzhorn <peter.ganzhorn@gmail.com>
Reviewed by:    zlei
Fixes:          https://cgit.freebsd.org/src/commit/?id=6d49b41ee84b iflib: Add pfil hooks
MFC after:      3 days
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2150

This ensures that child processes are reaped in the outer loop in
main().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294035
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=66b107e82b2f ("ctld: Use kevent(2) for socket events rather than select(2)")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56525

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293076
Reported by:    Ken J. Thomson <thomsonk@yandex.com>
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=969876fcee57 ("ctld: parse config file independently of getting kernel info")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D55767

This results in slightly less duplicated code.

Reviewed by:    asomers
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56526

With securelevel set (for pf that means >= 3) we're expected to reject
rule changes. However, we allowed interface flags to be changed, which
would allow 'set skip on X' to be changed.

Remove DIOCSETIFFLAG and DIOCCLRIFFLAG from the securelevel whitelist.

MFC after:      1 week
Reported by:    cyberkittens
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Extend the genl_cmd struct to allow calls to also carry a securelevel.
If that's set compare the current securelevel to only allow the call if
the level is lower than that.

If no value is specified continue to allow calls in any securelevel,
as before.

This allows us to easily implement the same securelevel restrictions for
pf as we have for the corresponding ioctls.

Reviewed by:    glebius
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D56390

Once we hand an mbuf over to netisr_queue() we may no longer access it.
Save the length before the call so we can use it to increment counters
afterwards.

Fixes:          https://cgit.freebsd.org/src/commit/?id=956acdce0505 ("loopback: Account for packet drops")
Sponsored by:   Rubicon Communications, LLC ("Netgate")

We are searching through the hash that has only wildcard bindings.
This was missed by fdb987bebddf05e15a5af840379c7715a94aec1c.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56488

After commit 9b76228006d8, tcp_hptsi() dereferences inp_socket in order
to get the inpcb's VNET.  This means that mock inpcbs created by the
HPTS test fixture must set inp_socket.  Also set the current VNET there;
previously, it was NULL, and this was not noticed since VNET_DEBUG is
disabled even in debug kernels.

Fixes:  https://cgit.freebsd.org/src/commit/?id=9b76228006d8 ("inpcb: retire inp_vnet")

The `pfctl -S` flag was added to disable DNS resolution in
<https://reviews.freebsd.org/D50724> but documentation and error
messages refer to a `pfctl -N` flag for the same purpose. The `pfctl -N`
flag performs an unrelated function, so the docs and error messages need
to be changed. Caught this when revising documentation for the `-N`
flag.

Reviewed by:    kp
Signed-off-by:  Ross Williams <ross@ross-williams.net>

After we found some preloaded z_initfirst object, we must process till
the end of the preload list still, not stopping on the first found
object.

Reported by:    des
Reviewed by:    des, markj, siderop1@netapp.com
Fixes:  https://cgit.freebsd.org/src/commit/?id=78aaab9f1cf359f3b7325e4369653f6b50593393
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56466

Initialize nla_geneve_link structure to zero to prevent
segfault when a TLV is not received by the netlink parser.

Reported by:    Seth Hoffert <seth.hoffert@gmail.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=688e289ee904 ("ifconfig: Add support for geneve (netlink)")

vm_vcpu_open() really should check the value returned from malloc() and
return NULL on failure. Also, all users of vm_vcpu_open() need to check
the returned value for NULL, too.

Reviewed by:    corvink, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56346

Prior to the change 4f809ffec69c, the sizes are formated by
humanize_number(3) with the flag HN_DECIMAL, which displays the result
using one decimal place when it is less than 10. That is more accurate
and useful. Add equivalent field modifier hn-decimal to xo_emit() to
restore the previous behavior.

Reported by:    Mark Millard
Reviewed by:    js
Fixes:          https://cgit.freebsd.org/src/commit/?id=4f809ffec69c gpart: add libxo support for "show" subcommand + man page updates
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56514

Compiling a LINT-NOIP kernel (assumingly also a NOINET) port and ip
are set but not used in nfsrv_getclientipaddr().

Hide the variables behind #ifdef checks and do likewise for the parsing
results.  Admittingly the code probably wants to be rewritten one day.

Found with:     gcc15 tinderbox build
MFC after:      3 days
Reviewed by:    rmacklem
Differential Revision: https://reviews.freebsd.org/D56502

Under conditions of low memory, getblk can fail.  fusefs was not
handling those failures very systematically.  It was always using
PCATCH, which appears to have been originally copy/pasted from the NFS
client code, but isn't always appropriate:

* During fuse_vnode_setsize_immediate, which can be called from many
  different VOPs and from the vn_delayed_setsize mechanism, remove
  PCATCH.  Some of these callers cannot tolerate allocate failure.

* In fuse_inval_buf_range, don't assume that getblk will always succeed.

* When calling fuse_inval_buf_range from VOP_ALLOCATE,
  VOP_COPY_FILE_RANGE, or VOP_WRITE (with IO_DIRECT), return EINTR if
  the allocation fails.

* When calling fuse_inval_buf_range from VOP_DEALLOCATE, remove PCATCH.
  This VOP must not fail with EINTR.

No new tests, because I can't force any particular getblk call to fail.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293957
Sponsored by:   ConnectWise
Reported by:    zjk7@wp.pl
MFC after:      1 week

Reviewed by:  markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

Reported by:  Ricardo Branco <rbranco@suse.com>
Reviewed by:    markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

- kaudit_to_bsm: Log IPv6 as well as IPv4 and unix addrs
- au_to_sock_inet128: Treat ports the same way as au_to_sock_inet32() as
  just pushing a uint16 causes byte ordering problems on little endian.

Differential Revision: https://reviews.freebsd.org/D39633
Sponsored by: Netflix
Reviewed by: csjp

The TIOCNOTTY handler detaches the calling process from its controlling
terminal.  It clears the link from the session to the tty, but not the
pointers from the tty to the session and process group.  This means that
sess_release() doesn't call tty_rel_sess(), and that pgdelete() doesn't
call tty_rel_pgrp(), so the pointers are left dangling.

Fix this by clearing pointers in tty_drop_ctty().  Add a standalone
regression test.

Approved by:    so
Security:       FreeBSD-SA-26:10.tty
Security:       CVE-2026-5398
Reported by:    Nicholas Carlini <npc@anthropic.com>
Reviewed by:    kib, kevans
Fixes:          https://cgit.freebsd.org/src/commit/?id=1b50b999f9b5 ("tty: implement TIOCNOTTY")
Differential Revision:  https://reviews.freebsd.org/D56046

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set.  More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not check whether the request covers a "boundary" vm
map entry.  Fix this, add the missing PG_PS test, and add some tests.

Approved by:    so
Security:       FreeBSD-SA-26:11.amd64
Security:       CVE-2026-6386
Reported by:    Nicholas Carlini <npc@anthropic.com>
Reviewed by:    kib, alc
Differential Revision:  https://reviews.freebsd.org/D56184

The epoch(9) subsystem implements per-CPU queues of object destructors
which get invoked once it is safe to do so.  These queues are polled via
hardclock().

When a CPU is about to go idle, we reduce the hardclock frequency to 1Hz
by default, to avoid unneeded wakeups.  This means that if there is any
garbage in these destructor queues, it won't be cleared for at least 1s
(and possibly longer) even if it would otherwise be safe to do so.

epoch_drain_callbacks() is used in some places to provide a barrier,
ensuring that all garbage present in the destructor queues is cleaned up
before returning.  It's implemented by adding a fake destructor in the
queues and blocking until it gets run on all CPUs.  The above-described
phenomenon means that it can take a long time for these calls to return,
even (especially) when some CPUs are idle.  This causes long delays when
destroying VNET jails, for instance, as epoch_drain_callbacks() is
invoked each time a network interface is destroyed.

Work around this problem by not disabling the hardclock timer if there
is garbage present in the destructor queues.  The implementation of
epoch_drain_callbacks() has other problems, but this small change on its
own gives a good improvement, especially when running networking
regression tests.  Moreover, we should aim to invoke destructors in a
timely manner, so the change is generally beneficial.

Reviewed by:    glebius
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D56508

Sort the options in each of the sections alphabetically.

Sponsored by:           Netflix

The test verifies that a socket can bind to a local address assigned by
connect(2) to a different socket.  It was however trying to bind to the
wrong address, and the check of the result was inverted, so this went
unnoticed.  It also needs to set SO_REUSEADDR for this to succeed.

Reported by:    glebius
MFC after:      1 week

The underlying bugs which caused them to be flaky are now fixed.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258766

This prevents unwanted change when saving files on IDEs (e.g. VSCode,
Zed)

Signed-off-by: Minsoo Choo <minsoo@minsoo.io>
Sponsored by:   The FreeBSD Foundation
Pull request:   https://github.com/freebsd/freebsd-src/pull/2152

Fixes:                https://cgit.freebsd.org/src/commit/?id=d8fbbd371ca1 ("zfs: merge openzfs/zfs@https://cgit.freebsd.org/src/commit/?id=1644e2ffd")
Reported by:    Jenkins

Due to FreeBSD-specific code it seems a code update was not applied
to the FreeBSD part during the v6.17 driver update.
Add the missing lines.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=b35044b38f74c