FreeBSD git weekly: 2026-06-08 to 2026-06-14

The Linux getsockopt did not check the size of the provided buffer when
copying out the value, leading to buffer overflows (e.g., for TCP_INFO).

Fix is to use the smaller of the option value size and the provided
buffer.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D55881

Implement the getsockopt for TCP_INFO by mapping FreeBSD's version to
what Linux expects.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D55882

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295893
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57493

Removes the file size limit for -C comparisons. The limit was
meant to prevent oversized mmap allocations, which is no longer
relevant as mmap is no longer used here (removed by
a0439a1b820fa0e742c00d095f5f5c06f5f19432, review D44809).
Credit to bdrewery.
See: https://reviews.freebsd.org/D57230

Reviewed by:    bdrewery, glebius, ziaee
Approved by:    glebius (mentor)
Obtained from:  Fudo Security
MFC after:      2 weeks
Sponsored by:   Fudo Security
Differential Revision:  https://reviews.freebsd.org/D57503

Replace the unconditional fflush(stdout) in grep_printline and
procmatches with a periodic timer that flushes at most once every
100ms.  This preserves interactive responsiveness (grep | tee,
grep | tail -f) while avoiding 1M+ write(2) syscalls when
processing large inputs.

The flush interval is tracked via clock_gettime(CLOCK_MONOTONIC)
and a static timespec.  --line-buffered continues to flush
immediately via setlinebuf(3), as before.

Benchmark on 1M lines (37MB output to file):
  unconditional fflush:  1.90s  (sys 1.22s)
  periodic 100ms timer:   0.49s  (sys 0.007s)

Reviewed by:            kevans
Differential Revision:  https://reviews.freebsd.org/D57528

The -w option checks word boundaries before and after each potential
match by decoding the adjacent character.  This was done via the
heavyweight sscanf(3) with "%lc", which goes through the full scanf
parser and locale-aware mbrtowc(3) machinery even for simple ASCII.

Replace with a three-tier fast path:

1. ASCII bytes (< 0x80): simple isalnum(3) / '_' comparison
2. UTF-8 continuation bytes (0x80-0xBF): interior bytes of a multi-byte
   character are always word characters -> no further decoding needed
3. Multi-byte start bytes (>= 0xC0): decode with mbrtowc(3) directly
   instead of sscanf(3)/%lc, avoiding scanf parser overhead

Benchmark with ministat(1) (10 runs each):

Worst-case ASCII (100k lines of 100 'a' chars, -w 'a'):
    Difference at 95.0% confidence: -15.3% +/- 3.1%

Worst-case Unicode (50k lines of 100 accented 'e', -w 'e'):
    Difference at 95.0% confidence: -11.2% +/- 4.7%

Normal -w (500k lines, -w 'the'):
    Difference at 95.0% confidence: -18.1% +/- 3.6%

French text (100k lines, -w accented 'ete'):
    Difference at 95.0% confidence: -18.0% +/- 4.1%

Non -w case shows no regression.

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D57587

While here, remove "The following UDF specific options are available:".
It is unused and does not appear to have ever been used.

MFC after:      3 days

MFC after:    1 week

MFC after:    3 days

No existing tests require it, and I cannot understand what kinds of test
scenarios are supposed to require it.  Just remove it.

While here, improve the documentation of test variables a bit.

Reviewed by:    ngie
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56604

The --si option (human-readable output with SI units based on
powers of 1000) was implemented but missing from both the SYNOPSIS
and the options list.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=265199
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2104

Since commit 97e13037915c, the -P flag works without -R as
required by POSIX. Update the man page to state that only -H
and -L are ignored without -R, while -P can be used independently.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289959
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2102

The FILES section listed /tmp/R* but the source code uses
/tmp/mail.R* (e.g. mail.RsXXXXXXXXXX, mail.ReXXXXXXXXXX,
mail.RxXXXXXXXXXX) as the mkstemp template prefix.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289980
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2103

The clone_root script was removed from the tree in commit
7736786b08e8 but the diskless(8) man page still referenced it
in two places. Remove both references.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292231
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2101

Add documentation for the vt_font, vt_keymap, vt_repeat, vt_saver,
vt_screenmap, and vt_ttys commands which are available at runtime
but were not listed in the man page.

Also clarify that the existing syscons_* commands are for the
syscons(4) console driver and remove stale commented-out entries.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291051
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2100

The man page only mentioned jumbo frame support for the 8169, 8169S,
and 8110S chips. The 8168 and 8111 family also support jumbo frames,
with varying MTU limits depending on the chip revision (6K for C
variants, 9K for D and later). Update the documentation to reflect
the actual driver capabilities.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=160399
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2097

Add documentation for the ATU (Address Translation Unit) commands
that were implemented but not documented in the man page:

- atu dump: display the MAC address table
- atu flush all: clear all dynamic ATU entries
- atu flush port <n>: clear ATU entries for a specific port

Also add atu to the SYNOPSIS section.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275413
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2096

The man page incorrectly stated that hdestroy() calls free(3) for
each comparison key. The implementation (hdestroy_r.c) only frees
the internal table structure, not the user-provided keys or data.
This matches POSIX, which says hdestroy "shall dispose of the
search table" without mentioning key deallocation.

Update the description to clarify that the caller is responsible
for freeing any memory associated with table entries.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291240
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2095

Suggested by: olce
Sponsored by:   The FreeBSD Foundation

This change documents the recently introduced changes to -p
that allow users to specify CPU ranges instead of having to
specify each individual mapping.

While we're here, move the -p examples to the EXAMPLES section.

Reviewed by:    bcr
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57480

MFC after:    3 days

The amd64 UEFI loader executes in long mode, not protected mode.

Reviewed by:    kib
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57568

Reviewed by:  kib
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57569

Two bugs in the firewire bus layer that affect all consumers (
if_fwip, sbp):

watchdog_clock was a static local in firewire_watchdog(), shared across
all firewire_comm instances.  With two controllers (e.g. built-in +
Thunderbolt Display), both advance the same counter, so the second
controller's 15-second boot-time timeout guard expires prematurely.

fw_tl2xfer() released tlabel_lock before returning the xfer pointer.

Reviewed by:    zlei, adrian
Differential Revision:  https://reviews.freebsd.org/D57496

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57329

Packets received with the following configuration are associated with
AXGE_RX_MII_ERR, which looks legit since there's no AXGE_RX_CRC_ERR
or AXGE_RX_DROP_PKT attached:

        axge0: <ASIX Elec. Corp. AX88179, rev 2.10/1.00, addr 3> on usbus0
        miibus0: <MII bus> on axge0
        rgephy0: <RTL8169S/8110S/8211 1000BASE-T media interface> PHY 3 on miibus0
        rgephy0: OUI 0x00e04c, model 0x0011, rev. 5
        rgephy0:  none, 10baseT, 10baseT-FDX, 10baseT-FDX-flow, 100baseTX, 100baseTX-FDX, 100baseTX-FDX-flow, 1000baseT-FDX, 1000baseT-FDX-master, 1000baseT-FDX-flow, 1000baseT-FDX-flow-master, auto, auto-flow

Without this, 'dhclient ue0' never gets valid lease as all the DHCP
replies are dropped by the driver.

This behaviour is align with the reference driver provided by the
vendor(ASIX_USB_NIC_Linux_Driver_Source_v3.5.0.tar.bz2).

MFC after:      2 weeks

Approved by:  so
Security:       FreeBSD-SA-26:27.sound
Security:       CVE-2026-45258
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation

The channel buffer mapped by dsp_mmap_single() may be freed when the
device handle is closed, but the mapping persists beyond that, allowing
userspace to read or write memory owned by a different consumer.

Fix the problem by adding a reference counter to the sound buffer.
Define pager ops for the VM object returned by dsp_mmap_single() and use
them to manage the extra reference.

Add a regression test.

Approved by:    so
Security:       FreeBSD-SA-26:27.sound
Security:       CVE-2026-49417
Reported by:    Lexpl0it, 75Acol, Liyw979, Rob1n
Reviewed by     kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57393

 - ARM C1-Premium erratum 4193780
 - ARM C1-Ultra erratum 4193780
 - ARM Cortex-A76 erratum 4193800
 - ARM Cortex-A76AE erratum 4193801
 - ARM Cortex-A77 erratum 4193798
 - ARM Cortex-A78 erratum 4193791
 - ARM Cortex-A78AE erratum 4193793
 - ARM Cortex-A78C erratum 4193794
 - ARM Cortex-A710 erratum 4193788
 - ARM Cortex-X1 erratum 4193791
 - ARM Cortex-X1C erratum 4193792
 - ARM Cortex-X2 erratum 4193788
 - ARM Cortex-X3 erratum 4193786
 - ARM Cortex-X4 erratum 4118414
 - ARM Cortex-X925 erratum 4193781
 - ARM Neoverse-N1 erratum 4193800
 - ARM Neoverse-N2 erratum 4193789
 - ARM Neoverse-V1 erratum 4193790
 - ARM Neoverse-V2 erratum 4193787
 - ARM Neoverse-V3 erratum 4193784
 - ARM Neoverse-V3AE erratum 4193784

These are all variants on an erratum where TLBI+DSB instructions on
one CPU may incorrectly complete early leading to stores to an updated
address using an incorrect translation on another CPU.

In all cases the workaround is to add a second TLBI+DSB.

Approved by:    so
Security:       FreeBSD-SA-26:31.arm64
Security:       CVE-2025-10263
Sponsored by:   Arm Ltd

AMD does not have a CPUID bit to indicate the lack of K8 PMCs.  If all
other PMC features are not present we should test an event selector to
see if it stores and returns a value.  If the VM is implemented
correctly, this should result in a #GP on the initial wrmsr_safe.  Bhyve
and a few other VMs ignore writes, so I got one step further and test
that it retains the OS and USR bits.

Tested on Zen 5 native and a Zen 5 Bhyve virtual machine.  This code
should not run on any recent hardware, except in a VM, as it checks that
the core counter extension is missing.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268943
Reported by:    Sandipan Das, John F. Carr <jfc@mit.edu>
Reviewed by:    mhorne, imp
Sponsored by:   Netflix
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2272/changes

* Force the type of the literal `1` passed to nstosbt() to ensure it's a
  64-bit type (or larger).  Otherwise it gets inconveniently typed to
  int, resulting in truncation.
* Use `flsll()` when converting sbt to power-of-2-nanoseconds to fix
  32-bit compatibility.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292616
Obtained from:  Hewlett Packard Enterprise
Fixes:  https://cgit.freebsd.org/src/commit/?id=26d6617f3 ("watchdog: Convert to using sbintime_t format")
MFC after:      3 days

The Book-E watchdog is effectively a state machine based around an AND
mask of the timebase register.  A single bit (0-63) is watched in the
timebase register, and when it transitions (by counting *or* by
programmatically setting) an exception is triggered.  The first
exception triggers a core interrupt.  The second is programmable.
In our case, we panic on the first and reset on second.

This patch aligns the return values of freebsd32_{set,swap}context()
with their counterparts on amd64 and powerpc64, fixing the setcontext()
and swapcontext() calls in armv7 applications running on aarch64.

In particular, this fixes random crashes in armv7 Ruby applications
running on aarch64 hosts.

Tested by:      fuz
MFC after:      1 week

This feature is utilized when updating storage capacity in capable hypervisors such as QEMU.

Reviewed by:    imp
Approved by:    imp(mentor)
Obtained from:  Fudo Security
MFC after:      2 weeks
Sponsored by:   Fudo Security
Differential Revision:  https://reviews.freebsd.org/D57247

only those originated by mouse.  Because the terminal surrounds
requests to vt(4) with locking.

Reported by:    bz, adrian
Reviewed by:    adrian, glebius
Approved by:    glebius (mentor)
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57442

Add two new subdevice IDs for E810-XXV-2 and E810-XXV-2 for OCP 3.0.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    kbowling, erj, mateusz.moga_intel.com
Sponsored by:   Intel Corporation
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54069

When interface was connected to a link partner with a cable
type limitting maximum supported speed, e.g. SFP+ cable
in 25G port, driver incorrectly saved a supported speed
as the user configured speed. This prevented interface
from using all supported speeds after switching cable to SFP28.
Link was established at 10G as supported by previously used
SFP+ cable. Don't set user requested speed unless actually
configured by an user, to allow automatic selection of highest
available speed. Only when user sets custom config
using advertise_speed sysctl save it and try
to apply after cable is changed.

Also don't save initial supported speeds if FW supports
reporting default PHY config.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    kbowling, erj, mateusz.moga_intel.com
Sponsored by:   Intel Corporation
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D53611

Reported by:  Alex S <iwtcex@gmail.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Add a sysctl entry for the evdev device number (devnum) to allow
libudev-devd to populate the corresponding device information
fields (MAJOR and MINOR) when running in a jail with no input devices
exposed through devfs.

Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>

Reviewed by:    wulf
Sponsored by:   Defenso
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56968

Do not jump to the resource release path when bus_alloc_resource_any()
fails, since no MMIO resource was allocated. If a10_intr_pic_attach()
fails after the MMIO resource has been allocated, release it before
returning.

Signed-off-by:  Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by:    vexeduxr
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2253

Also remove the rid variable since it was unused.

Signed-off-by:  Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by:    vexeduxr
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2255

The Apple T2 (ANS2, PCI 106b:2005) requires several quirks:

- 128-byte submission queue entries (CC.IOSQES = 7)
- Single MSI vector, one IO queue
- Admin and IO queues share a CID table; IO CIDs offset by
  adminq.num_trackers to avoid overlap
- No async event support
- IDENTIFY CNS >= 2 rejected to avoid firmware confusion

Tested-on:
- MacBookPro16,2 (A2251)
- Mac mini 8,1 (A1993)
- Multiple Non-Apple computers

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57087

DMA ring transport between the host and the T2 coprocessor.
Provides mailbox handshake, queue setup, and firmware keepalive
for higher-level T2 services (VHCI, audio, etc.).

Tested-on: MacBookPro16,2 (A2251), Mac mini 8,1 (A1993)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57088

Implements a VHCI driver on top of the BCE transport:
- Virtual USB bus registration via usb_controller
- Port discovery and device enumeration
- Control, interrupt, and bulk endpoint support
- Firmware event handling with taskqueue
- Suspend/resume via BCE mailbox

Provides keyboard, trackpad, and Touch Bar access on T2 Macs.

Tested-on: MacBookPro16,2 (A2251), Mac mini 8,1 (A1993)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57089

asmc_key_dump() used I/O port macros (ASMC_DATAPORT_WRITE/READ,
asmc_command()) unconditionally. On T2 Macs, sc_ioport is NULL
(MMIO backend is used instead), causing a page fault when
ASMC_DEBUG triggers asmc_dumpall() during attach.

Add an MMIO guard at the top of asmc_key_dump(): delegate to
asmc_key_dump_by_index() + asmc_key_read() for MMIO devices,
consistent with the rest of the T2 code paths.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56748

BCM57766 on Apple T2 Macs (Macmini8,1) has no dedicated EEPROM and the
chip firmware handshake fails (the T2 intercepts PCI config space),
leaving the SRAM mailbox unpopulated.  All four existing MAC retrieval
paths (SRAM mailbox, NVRAM, EEPROM, firmware stub) fail, causing bge to
abort attach with "failed to read station address".

Work around this with two changes:

  1. Tolerate EEPROM read failure on BCM57766.  The chip is copper-only
     so hwcfg=0 is correct; skip the fatal error that aborts attach
     before bge_get_eaddr() is ever called.

  2. Implement bge_get_eaddr_fw() to read a "hint.bge.N.mac" string
     (e.g. "f0:18:98:f4:1e:2f") from loader(8) tunable / kenv.

This is a workaround until the T2 BCE API is understood well enough to
either poke the chip firmware into completing its handshake or read the
MAC from the T2 directly.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57090

When we undefer a packet (when the peer acks the state) it's possible
that we don't find a corresponding pfsync_deferral. We panic here, but
that's actually something that can happen in normal operation:
 - if we have too many deferred packets already (in pfsync_defer())
 - if the deferral timed out (in pfsync_defer_tmo())

Remove this panic and document the scenarios where it might occur.

MFC after:      2 weeks
Sponsored by:   Orange Business Services

A PPTP client sending a specially crafted PPTP message with a length
smaller than the already processed fixed header can panic the system.
This resultes in a negative remaining length (a large unsigned 16-bit
number).

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.1 from
                Z.ai
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57383

krb5 1.22.1 erroneously removed a check from get_negTokenResp() for
successful decoding of the mechListMIC field.  Restore the check to
prevent a null pointer dereference.

Commit message details obtained from upstream commit.
Obtained from:  Upstream commit 4ae75cded
MFC after:      3 days

If a name token contains trailing garbage, error out from
krb5_gss_import_name() instead of crashing the process with an
assertion failure.

Commit message details obtained from upstream commit.
Obtained from:  upstream commit 07818f1fd
Reported by:    Aisle Research (Ze Sheng, Dmitrijs Trizna,
                Luigino Camastra, Guido Vranken) to krb5-bugs
MFC after:      3 days

nlmsghdr::nlmsg_len and nl_buf::offset are u_int.  Make msglen match.

Reviewed by:    pouria, glebius
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57474

Discarding m_free's return value will result in an mbuf leak if the mbuf
was in a chain.

In general we should use m_freem if the mbuf may be in a chain, or
assert that the return was NULL.  There will not be a chain here due to
m_megapullup, so add an assert.

Reviewed by:    ae
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57479

After commit 069a67374ed9, ip6_input() quickly rejects packets with
plen == 0, before ip6_input_hbh() is called.  So, there is no need to
check this condition again in the helper function.

Reviewed by:    pouria, zlei, tuexen
Differential Revision:  https://reviews.freebsd.org/D57342

libalias maintains a global list of all libalias handles.  The list was
updated without any locking, but nothing prevents updates from running
concurrently.

MFC after:      1 week

Describe the ieee80211_task API, why its used and some of
its shortcomings.

Differential Revision:  https://reviews.freebsd.org/D57261

This hasn't been used in a long time, and since I am shuffling around
the net80211 crypto API a bunch, let's just delete it instead of
leaving it here and trying to figure out how to support it if it's
used by userland somehow.

Reviewed by:    guest-seuros
Differential Revision:  https://reviews.freebsd.org/D57312

We drop the inpcb lock in order to copy in the source list, but this
leaves a window where the multicast filter structure might be freed.
This can be exploited to obtain root privileges.

In the v4 code this race is mitigated by holding the global multicast
lock across the gap.

Restructure the code to copy in filters before doing anything else, so
that there's no need to drop the inpcb lock and reason about the
correctness of doing so.  Do the same in the v4 code for consistency.

Approved by:    so
Security:       FreeBSD-SA-26:29.ip6_multicast
Security:       CVE-2026-49412
Reported by:    Andrew Griffiths <andrew@calif.io>
Reported by:    Maik Münch <maik@secfault-security.com>
Reviewed by:    glebius
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57347

This fixes a panic reported on armv7:

sys/netpfil/pf/counters:match_block  ->  panic: free: called with spinlock or critical section held
[...]
vpanic() at vpanic
         pc = 0xc0321b5c  lr = 0xc02f7b5c (free+0x140)
         sp = 0xc8c858bc  fp = 0xc8c858e0
         r4 = 0xe2fad648  r5 = 0xe402ce78
         r6 = 0xc8c859e8  r7 = 0x0000001c
         r8 = 0xc8c858b4  r9 = 0xc0321b5c
        r10 = 0xc8c858bc
free() at free+0x140
         pc = 0xc02f7b5c  lr = 0xe2f4f920 ($a+0x5f8)
         sp = 0xc8c858e8  fp = 0xc8c85930
         r4 = 0xe402ce68  r5 = 0xc8c8599c
         r6 = 0xffffffff r10 = 0x0000001c
[...]
KDB: enter: panic

Consequently, this fixes armv7 CI:
https://ci.freebsd.org/job/FreeBSD-main-armv7-test/2287/consoleText

Fixes:  https://cgit.freebsd.org/src/commit/?id=6353f5d9a5c6f194bb014b8785a57f5314e8c652
Reviewed by:    kp
MFC after:      3 days

Multipath routes can be added via both RTM_F_CREATE and RTM_F_APPEND.
Therefore, it's possible to have mpath routes without calling
add_route_flags_mpath.

Instead of checking V_fib_hash_outbound for every route append,
check it during nhgrp_ctl initialization, which is only called for
the first multipath request per rib_head.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293136
Reviewed by:    glebius
Tested by:      Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Differential Revision:  https://reviews.freebsd.org/D57469

Sponsored by: Beckhoff Automation GmbH & Co. KG

Currently, 'write_files' does not create parent directories, and
'runcmd' cannot be used here, since those scripts run after the files
have been written. The only workaround is to create the files in an
existing directory, such as '/root' or '/tmp', and then move those
files using 'runcmd', but this is cumbersome when there are many files,
even if they are small.

With this change, nuageinit now creates the parent directories for each
file using the path field, which mimics the same behavior as in
cloud-init.

Permissions and ownership can also be configured using 'runcmd'.

Reviewed by:            bapt@
Approved by:            bapt@
Differential Revision:  https://reviews.freebsd.org/D57395

If virtual_oss is not enabled when these rules run on startup, dmesg
will show the following messages:

Starting devd.
virtual_oss_cmd: Could not open control device: /dev/vdsp.ctl: No such file or directory
virtual_oss_cmd: Could not open control device: /dev/vdsp.ctl: No such file or directory

Reported by:    olce, Mark Millard <marklmi@yahoo.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

nuageinit: use single-quote shell escaping for hostname in rc.conf.d

The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside double quotes, so a hostname containing $() or backticks would
be executed when the file is sourced (e.g., by rc(8)).

Switch to using the existing shell_escape() helper, which wraps values
in single quotes. In POSIX shell, single-quoted strings are completely
literal — no expansion or substitution of any kind is performed.

While the hostname is already validated to contain only
[a-zA-Z0-9.-], this change provides defense-in-depth so the output
format is safe regardless of future validation changes.

Reported by:    Yazdan Soltani <yazdan.soltani@gmail.com>

nuageinit: fix shell command injection in multiple rc.conf.d writes

nuageinit: fix shell injection in power_state_change delay and add test

nuageinit: validate set-name to prevent shell injection in variable names

Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.

When `boot_policy` is `RELAXED`, `find_currdev()` tried ZFS pools on every
disk before searching the boot ESP and sibling partitions. Booting install
media from USB could therefore select an installed ZFS root on internal
storage instead of the intended memstick UFS image.

Extract the boot-device partition walk into `try_boot_device_partitions()`
and run it before relaxed foreign-pool probing. The ZFS search order is
preserved; pools on the boot device are tried first, followed by pools on
other devices when `boot_policy` is `RELAXED` and the boot device yields
no bootable root.

Signed-off-by: Faraz Vahedi <kfv@kfv.io>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2239

Signed-off-by: Phil Krylov <phil@krylov.eu>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1735

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1700

ppp: Don't fetch a non-existent variadic argument

Only fetch the optional mode argument to ID0open to pass to open(2) if
O_CREAT is present in the flags argument.  It is UB to fetch an
argument that doesn't exist.  On CHERI this UB results in a fault.

Reviewed by:    brooks
Obtained from:  CheriBSD
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D57137

ppp: Permit CHAP challenges up to 255 bytes

RFC 1994 does not place any limit on the length of the value field in
challenge messages except that the length is a single octet which
bounds the maximum length to 255.

NB: I'm not sure why the local[] and peer[] arrays contain room for an
authentication name (AUTHLEN) in addition to a challenge value/response,
but I've just left that in place.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271955
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D57138

ppp: Reject FSM messages whose length is smaller than the message header

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271843
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    des, emaste
Differential Revision:  https://reviews.freebsd.org/D57139

While here, use the more specific "pidfile" consistently instead of
ambiguous "filename".

Reviewed by:    ziaee
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57531

virtual_oss(8) does not currently keep track of the cuse(3) it creates,
nor does it destroy any of them on exit, except for the control device.
This is harmless if virtual_oss(8) is killed after all audio streams
have been shut down, but if it's killed during I/O, the process hangs
and/or goes into uninterruptible sleep state.

To fix this, have pointers to all cuse(3) devices, and explicitly
destroy them on exit. Also make sure we don't leak memory in
dup_profile().

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    jrm
Pull-Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/41

There is no reason to have per-profile copies, plus this way we open
/dev/sndstat multiple times if more than 1 profile is created.

Also close the FD on exit to avoid leaking.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    jrm
Pull-Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/41

_loopback entry in `static_routes` ensures a loopback route
exists in all routing tables.
However, loopback routes may already be added by the kernel.
Therefore, re-adding them triggers an `EEXIST` error on every boot.
This change suppresses those harmless errors.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259553
MFC after:      1 week
Reviewed by:    glebius, jlduran, markj
Differential Revision:  https://reviews.freebsd.org/D57470

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  des, dim
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57549

Reviewed by:  des, dim
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57549

C++ exposes cfenv functions via using ::func. Our name-mangling
mechanism rewrites all function calls causing symbols such as
std::feclearexcept to be transformed into std::__feclearexcept_int.
Since no such function exists, compilation fails.

The using ::feclearexpect declarations themselves are unaffected because
they are not function calls, which further exposes the mismatch

As a result, enable the fast path only for C and fall back to the slow
path in C++.

Reviewed by:    kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=5bc64b7d417d
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57450

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D56992

Replace the `(bool(*)(bool))` probe in `__assert_sanitize()` with an unevaluated
conditional expression, so types with `explicit operator bool()` that require a
contextually converted constant expression of type `bool` are handled correctly.

Ergo, arity check is now performed separately via `__assert_sanitize_arity()`, a
unary template whose parameter pack must bind to exactly on argument after
`__VA_ARGS__` is substituted into the call.

Also align NDEBUG with C23 requirements.

Reported by:    dim, aokblast
Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Reviewed by:    aokblast, fuz
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=867b51452ea78ece0b312a387e63fdbc2a11056a
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2265

C23 deprecates <stdalign.h> and specifies that the header shall
provide no content (§7.15.1).

Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2223
MFC after:      1 month
Reviewed by:    imp, fuz

Regenerate gd_qnan.h on riscv using the qnan.c
config tool found in contrib/gdtoa.

This fixes the following tests in CI:
lib/libc/stdio/scanfloat_test:infinities_and_nans
lib/libc/stdlib/strtod_test:strtold_nan

Reviewed by:    jrtc27
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57405

Look up the pfctl family id when we open the handle, rather than for
every function call.
This saves us a lot of netlink calls, at the expense of storing one
extra int in the handle.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

When we snl_init_writer() we allocate memory in the struct snl_state in the struct pfctl_handle.
This memory was never released again, leading to a memory leak. We still
had a reference to the memory and would release it on pfctl_close()
(so valgrind did not detect it as a leak), but long-lived users (e.g.
bsnmpd) would eventually run out of memory.

Explicitly reset the snl_state when we're done to prevent this.

MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Commit 6e7c10c79dea fixed a couple of snprintf()s for large
uid/gid numbers above 2Gig.  This patch fixes another one.

Reviewed by:    rmacklem
Differential Revision:  https://reviews.freebsd.org/D57561

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=272896
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    des, emaste
Differential Revision:  https://reviews.freebsd.org/D57135

The extra search for an FEXEC fufh shall be removed, since readdir
is only supposed to be called on a directory opened with FREAD.  The
sole exception is NFS, which will call VOP_READDIR with directories that
aren't open at all.  fuse already has special code to handle that.

Also remove the fuse_filehandle_get_dir() function, since it's not
used anywhere else.

Signed-off-by:  CismonX <admin@cismon.net>
Reviewed by:    asomers
MFC after:      2 weeks
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1729

When trying to delete or rename a file, fuse_vnop_lookup must check
whether its parent directory's sticky bit is set.  Realistically, the
parent directory's attributes will almost always be cached.  But it's
possible that they won't be, and in that case we must send a new
FUSE_GETATTR request to the server.  If that request fails for some
reason, then we must fail the lookup.  Prior to this change fusefs would
ignore failure of that request.

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu of Tsinghua University
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D57588

Althought non-compliant, there are binaries which have the phdrs placed
unaligned in the image.  Since we have the code to allocate memory for
off-page phdrs, the same code path can be used to handle unaligned
phdrs.

Relax the requirement for both the activated image and interpreter.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295629
Reviewed by:    emaste, markj, olce
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57498

The remote syscall is executed in the context where debugger owns a
p_lock hold on the target.  Due to this, exit1() waiting for p_lock
going to zero, never happen.

Postpone the exit1() call to ast then, saving the provided rval and
signo in the struct proc.  Mark the async-exiting proc with the new
p_flag P_ASYNC_EXIT.

While p_xexit can be reused, p_xsig can be only set by actual exit1(),
otherwise it breaks the ptrace mechanism. Allocate a dedicated p_asig
for it.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57482

The Linux getsockopt did not check the size of the provided buffer when
copying out the value, leading to buffer overflows (e.g., for TCP_INFO).

Fix is to use the smaller of the option value size and the provided
buffer.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D55881

The IEEE80211_KEYBUF_SIZE and IEEE80211_MICBUF_SIZE are sprinkled
throughout the net80211 stack, ioctl API and drivers.  This makes it
challenging to (eventually) up IEEE80211_KEYBUF_SIZE to support 256 /
384 bit encryption as, well, it'll break every single driver and the
ioctl API in doing so.

So as part of this, let's start to separate out the current key/mic
buffer size from what drivers and the ioctl layer are using.
Drivers especially shouldn't be using these definitions as their
key sizes are hardware / firmware API limits, not net80211 limits.
Ideally drivers would define their own key buffer / mic buffer
sizes and only copy in keys up to that length (and fail keys
that are too large) but the current net80211 API isn't there yet.

This doesn't yet change what defines / buffer sizes are used in the
ioctl layer.  I'm going to plan out some subsequent work to
separate out those defines and ioctl APIs so they maintain using
the 128 bit key/mic buffer sizes and will copy them in/out of any
larger net80211 key buffer size in the future.

Differential Revision:  https://reviews.freebsd.org/D54593

tty: Add sysctl knob to globally disable TIOCSTI

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57233

vt: Rename sysctl to security.bsd.allow_tiocsti

This is consistent with allow_read_dir and allow_ptrace.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293485
Fixes: https://cgit.freebsd.org/src/commit/?id=c289291a6736 ("tty: Add sysctl knob to globally disable TIOCSTI")
Sponsored by: The FreeBSD Foundation

Approved by:  so
Security:       FreeBSD-SA-26:25.thr
Security:       CVE-2026-45256
Reported by:    Igor Gabriel Sousa e Souza
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by:    emaste, kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57237

Normally, data processed on the KTLS receive path is contained in
anonymous mbufs that can be modified in place.  Either the data
originates in receive buffers from a NIC driver, or for loopback
connections the data is anonymous-backed mbufs created when writing to
a socket.  One potential source of non-anonymous mbufs are mbufs
created by sendfile(2) which borrow the pages of the underlying file,
either via M_EXTPG or EXT_SFBUF that are sent over a loopback
connection.  For a well-formed loopback TLS session, the sender should
only use sendfile(2) if KTLS is enabled.  If TLS is fully handled in
userspace, the sender must use write(2) or send(2) which allocate
anonymous mbufs.  If KTLS transmit is enabled, then sendfile(2) on a
loopback connection will always use crypto via OCF and will allocate
anonymous pages to hold the encrypted data.

However, if sendfile(2) is used to send file-backed data directly over
a loopback connection where KTLS is not enabled on the sender side,
the KTLS receive path can modify the file-backed pages in place
overwriting the file's data.  One potential fix would be to replace
non-anonymous mbufs in a received TLS record with anonymous mbufs
(e.g. via m_dup()) before passing the record to OCF.  However, there
is no legitimate use case for using sendfile(2) over a loopback TLS
connection without using KTLS on the sender side, so instead simply
fail decryption requests and close the connection if non-anonymous
mbufs are encountered in the RX decryption path.

Add a test for this that verifies that the original data backing the
file descriptor used as the source for sendfile() is unchanged after
being processed.

Approved by:    so
Security:       FreeBSD-SA-26:26.ktls
Security:       CVE-2026-45257
Co-authored-by: Drew Gallatin <gallatin@FreeBSD.org>
Sponsored by:   Chelsio Communications
Sponsored by:   Netflix

The runtime linker in glibc relies on the AT_SECURE auxv entry to know
whether the executable is set-ugid, if so then various dangerous
functionality such as LD_PRELOAD is disabled.

The check added in commit 669414e4fb74 failed to take into account the
fact that during execve, P_SUGID may not yet be set for a set-ugid
process.  Correct the test.

Approved by:    so
Security:       FreeBSD-SA-26:30.linux
Security:       CVE-2026-49413
Reported by:    Minseong Kim
Fixes:          https://cgit.freebsd.org/src/commit/?id=669414e4fb74 ("Implement AT_SECURE properly.")
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57350

Otherwise an unprivileged user can disable randomization of the base
address for PIEs even if they are setugid.

Add a regression test.

Approved by:    so
Security:       FreeBSD-SA-26:32.elf
Security:       CVE-2026-49414
Reported by:    David Berard
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57397

This restores existing error code for connect(2) over unix domain socket
when the empty string is specified as socket address.

Reported by:    eduardo
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57509

proc: add tree ref count

Owning the reference prevents reuse of the struct proc.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57492

kern_fork: guard against NULL newproc on the failure path

Reported and tested by: pho
Fixes:  https://cgit.freebsd.org/src/commit/?id=85a65e393092 ("proc: add tree ref count")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Recalculate it to iterate over the right set of processes.

Prevent reaper' struct proc reuse by holding the tree ref on it.
Since our reference is taken under the proctree lock and we know that
the process is reaper, it cannot go away.  The process hold count
(p_lock) cannot be used there because p_lock intent is prevent exit, but
reaper owns its reap-children until reaped itself, i.e. even a zombie
reaper is still on duty.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57492

Reported by:  Yuxiang Yang, et al <yangyx22 at mails.tsinghua.edu.cn>
Discussed with: markj
MFC after:      3 days

Implement the getsockopt for TCP_INFO by mapping FreeBSD's version to
what Linux expects.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D55882

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295965
Reported and tested by: mandree
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57513

Reviewed by: imp,emaste
Pull Request: https://github.com/freebsd/freebsd-src/pull/1659

Reviewed by:  fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57525

Eliminate panic when re-setting a paused failpoint to pause
(address of feq_mtx changes whilst in mtx_sleep, triggering
assertion when reacquiring mtx).

Reviewed by:    rlibby
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2267

MFC after:    1 week

Specifically, do not let vtryrecycle() to recycle a used vnode. It is
possible for a vnode to be vref-ed or vuse-ed lockless after it is held
by vhold_recycle_free(). Then, since vtryrecycle() does not recheck the
hold count, we might end up freeing vused vnode.

Since vget_finish() increments v_usecount after obtaining the vnode
lock, we would observe the hold reference anyway when the parallel
vget() is blocked waiting on the vnode lock.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281749
Reported and tested by: Steve Peurifoy <ssw01@mathistry.net>, Vladimir Grebenshchikov <vova@zote.me>
Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57305

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56912

Use the avaliable space to introduce vnode-locked flag v_v2flag.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56912

The semantic of the flag has the natural march to the code scope that is
protected by the vnode lock.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56912

LinuxKPI: 802.11: add print masks for tx status flags

Add print masks for tx status flags and use them in the TX tracing
in order to more easily debug TX problems.

As a result it was easier to determine that some dirver like the mt7921
(or mt76) do not always zero the status bits of the tx status information
(it is a union with the control bits passed on TX) and thus we get bogus
values back (rather than having flags in a different place than we thought).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: set undefined link in TX control info

We are not doing MLO yet so set the undefined link bit in the
TX info control message in case a driver checks if the TX would be
link specific.

Sposnored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: improve hw_crypto key operations

mt7921 would happily receive traffic (MC/BC) and decrypt it correctly
when hw_crypto was used but TX would only have garbled data in frames.

The problem came from the fact with keys for which we do not have an
address the driver will pick the "sta" information from different places
(driver view of sta or vif).
In the downcall this is signalled by the sta argument being NULL as
the linux keyconf has no address field.

Us passing the sta for first the pairwise key and then also for the
group key likely overwrote the pairwise key on the sta and allowed
the MC/BC RX operations to succeed anyway (the observed behaviour).

Software crypto was fully fine for mt7921 and showed no problems.

Looking some other drivers:
- iwlwifi/mld picks the ap_sta if the sta argument is NULL; thus it
  always worked with our previous logic and this went unnoticed.
- rtw88 in rtw_sec_write_cam() decides whether to use the sta address
  or a broadcast address.
- rtw89 in rtw89_cam_attach_sec_cam() picks the rtwsta_link if sta is
  not NULL and has follow-up logic checking on that.

It is yet unclear if some of the MC problems observed on rtw8x
stem from the same problem.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: force update of net80211 crypto key flags

Several drivers (rtw8x, mt76) do not announce the supported ciphers suites
in the wiphy instance.  This means we never populate net80211 ic_cryptocaps
on device creation and thus not announcing any supported hw crypto
offload forcing a fallback to software crypto.

However when the mac80211 (*set_key) succeeds we know we can offload
crypto.  At that point the net80211 key flags have IEEE80211_KEY_SWCRYPT
set which we want to clear.  Historically the net80211 API does not
allow this though there should be no ill side effects (base on a
quick code inspection).  We thus have to DECONST the key argument
for now.  It is expected that with MFP support this will need to
become a common operation and the API will need to change as we
will only get the information of some details from the driver on a
per-cipher case when the (*set_key) downcall returns.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

With 2cf15144daf7e we added a kernel buffer for parsing input copying the
user buffer into that.  The problem is that we only copy exactly as many
bytes as the user supplied.  printf 1 would have a write_size of 1, while
echo 1 would have a write_size of 2 (1\n).  But in order to check and
parse we need a terminating '\0'.

Overallocate the kernel buffer by 1 and make sure it is always '\0'
terminated.

Remove the check that the string needs to be of different length than
the write_size as this will always fail unless the user passes in, e.g.,
"1\02\n\0" somehow in which case we won't bother as kstrto*ll() will
not only handle the '\n' but also stop at '\0' and should be fine or
it will fail and we will error.

In theory we could use a static buffer here as well as we know a maximum
possible length of digits plus \n and \0 and take a min of that buffer
length and write_size and then error on a small buffer but given this is
an optional debug interface, do not bother with any alloc (size).

Fixes:          https://cgit.freebsd.org/src/commit/?id=2cf15144daf7e ("lindebugfs: Pass user buffer pointers ..")
Sponsored by:   The FreeBSD Foundation
Reviewed by:    dumbbell
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D57522

In case the fill function fails do not report (read/write) but the
actual operation only given we can easily determine it.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell, emaste
Differential Revision: https://reviews.freebsd.org/D57523

In the ddb show callout function try to resolve the symbol of the
callout function to improve debugging.  In my case I went through
various callouts from show ktr to check what they were and this saved
me opening lldb/gdb next to it (and still having the old kernel as
the panic to debug was upon reboot).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    rlibby
Differential Revision: https://reviews.freebsd.org/D57521

Add lock assertions and "might_sleep" annotations to various
mac80211 operation downcalls into the driver.

Make sure the code to these is all covered by locks--pushing more wiphy
lock into the code--or lock assertions as well.  Split up parts of the
MC code up into an unlocked and locked version to avoid recurive locking.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Update the GCE image creation process to automatically apply the
'public-image=true' label when publishing new images. This aligns
with standard labeling expectations for images hosted in public
projects.

MFC after:      3 days

1e649491b8567151270095fda3bce8faea394952 enabled KERN_TLS in
riscv/conf/GENERIC, but didn't enable OPENSSL_KTLS.

This passes all testcases in the sys/kern/ssl_sendfile suite and
fixes CI failures seen here:
https://ci.freebsd.org/job/FreeBSD-main-riscv64-test/16606/testReport/sys.kern/ssl_sendfile/

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293810
Fixes:  https://cgit.freebsd.org/src/commit/?id=1e649491b8567151270095fda3bce8faea394952
MFC after:      3 days
Reviewed by:    gallatin, ngie
Differential Revision:  https://reviews.freebsd.org/D57316

Sponsored by: The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57366

In some cases having a src tree in a VM image is convenient
for development or debugging. Add a WITH_SRC variable,
which, when set, will cause the vm-release target to include
FreeBSD-set-src in the list of packages installed in an image.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Sponsored by:   Intel Corporation

Reviewed by:    cperciva
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57143

I've been the quasi-defacto component maintainer for OpenSSL since
14.0-RELEASE. Make it official via CODEOWNERS/MAINTAINERS.

The goal is to help guide those interested in making changes in this
space to solicit my input with the new vendor import process and
coordinate fixes with upstream until things are at a point where most of
this is automated a system of automated checks and balances to confirm
that the updates being made to the component help maintain a security
supply chain for this given component.

Thank you benl and jkim for your past efforts in this component area.
Hopefully I can do my part to help improve this critical space further
as you both did in your respective tenures.

MFC after:      3 days

Reviewed by:  kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57485

Reviewed by: imp,emaste
Pull Request: https://github.com/freebsd/freebsd-src/pull/1659

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1656

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1656

This fixes the readv_before_end and preadv_before_end test
timeout failures on riscv.

See https://ci.freebsd.org/job/FreeBSD-main-riscv64-test/lastCompletedBuild/testReport/lib.libc.secure/fortify_uio_test/readv_before_end/

Reviewed by:    kevans, emaste
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57420

Fixes this CI test failure: https://ci.freebsd.org/view/Test/job/FreeBSD-main-riscv64-test/16606/testReport/junit/sys.posixshm/memfd_test/hugetlb/

Reviewed by:    kevans
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57289

On my ZFS based systems, no allocations occur with tags "newblk" or
"freework". This leads to errors executing the tests that check for
memory leaks. Skip the checks if the output of wmstat -m does not
contain lines corresponding to those allocations.

MFC after:      3 days

Instead of varying only the low surrogate do also randomly choose a
suitable high surrogate.

MFC after:      3 days

Remove test for UFC-16 surrogate pairs in file names from this exclude
list, since kernel support has been committed and the test can be now
expected to succeed.

MFC after:      3 days

This test runs with rights of an un-privileged user writing to a file
system only writable by the owner. Since no UID was provided in the
mount command, the owner of the file system was "root", and thus
writing was not allowed for $testuser. Fix this issue by mounting
with "-u $testuser".

MFC after:      3 days

MFC after:    1 week
Differential Revision:  https://reviews.freebsd.org/D57147

MFC after:    1 week
Differential Revision:  https://reviews.freebsd.org/D57148

- s/deterimine/determine/

MFC after:      3 days

The Nd macro takes the rest of the line as an argument,
so there is no need for extra quoting.

MFC after:      3 days

- s/Diable/Disable/
- s/connonical/canonical/

MFC after:      3 days

- s/freqency/frequency/

MFC after:      3 days

- s/Diable/Disable/

MFC after:      3 days

- s/freqency/frequency/

MFC after:      3 days

- s/Diable/Disable/

MFC after:      3 days

- s/freqency/frequency/

MFC after:      3 days

- s/freqency/frequency/

MFC after:      3 days

- s/Sotrage/Storage/

MFC after:      5 days

- s/occurance/occurrence/
- s/Univeristy/University/

MFC after:      5 days

Rewrite the main loop to use ppoll() instead of just blocking on read,
blocking the signals we care about when we aren't polling.

I didn't bother replacing alarm() with setitimer(); the alarm code
is dead anyway since there is no way for max_idletime to acquire a
non-zero value.

While here, avoid leaking the pid file and trigger descriptors to the
log child.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295840
MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D57451

This is a rollup commit from upstream to fix:
  Reject oversized inputs in ASN1_mbstring_ncopy()
  cms: kek_unwrap_key: Fix out-of-bounds read in check-byte validation
  cms: kek_unwrap_key: test for fix out-of-bounds read in check-byte validation
  Avoid length truncation in ASN1_STRING_set
  pkcs12: verify that the pbmac1 key length is safe
  Reject potentially forged encrypted CMS AuthEnvelopedData messages
  QUIC stack must limit the number of PATH_CHALLENGE frames processed in RX
  Fix NULL dereference in QUIC address validation
  Fix potential NULL dereference processing CMS PasswordRecipientInfo
  Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_decrypt()
  Enforce implicit rejection for CMS/PKCS#7 decryption
  Use the correct issuer when validating rootCAKeyUpdate
  Match the local q DHX parameter against the peer's q
  Apply the buffered IV on the AES-OCB EVP_Cipher() path
  Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV
  Fix possible use-after-free in OpenSSL PKCS7_verify()

Approved by:    so
Obtained from:  OpenSSL
Security:       FreeBSD-SA-26:35.openssl
Security:       CVE-2026-7383
Security:       CVE-2026-9076
Security:       CVE-2026-34180
Security:       CVE-2026-34181
Security:       CVE-2026-34182
Security:       CVE-2026-34183
Security:       CVE-2026-42764
Security:       CVE-2026-42766
Security:       CVE-2026-42767
Security:       CVE-2026-42768
Security:       CVE-2026-42769
Security:       CVE-2026-42770
Security:       CVE-2026-45445
Security:       CVE-2026-45446
Security:       CVE-2026-45447

Approved by:  so
Security:       FreeBSD-SA-26:36.ldns
Security:       CVE-2026-10846

This change is a security release which resolves several issues with OpenSSL 3.5,
the highest severity issue being ranked "High". Users are strongly encouraged to
update to this release.

More information about the release (from a high level) can be found in
the release notes [1].

1. https://github.com/openssl/openssl/blob/openssl-3.5.7/NEWS.md

All conflicts were resolved with `--theirs`, taking the release diff
over the local diff; the conflicts occurred due to preemptive security
fixes applied by so@ in e508c343.

MFC after:      3 days (the important security issues have been
preemptively addressed)
Merge commit '3a71a35ad9dad0e5d2cad8efecc8ba9d57c42d43'

Conflicts:
        crypto/openssl/include/internal/quic_channel.h
        crypto/openssl/ssl/quic/quic_channel_local.h
        crypto/openssl/ssl/quic/quic_rx_depack.c
        crypto/openssl/test/cmsapitest.c
        crypto/openssl/test/evp_extra_test.c

MFC after:    3 days
MFC with:       1523ccfd9

This diff reduces with the content provided by upstream (OpenSSL).

MFC after:      1 week

This particular change didn't come from upstream. It was added locally
in 7a991ecd1 when attempting to enable the fips provider with 3.0.

Given the fact that we no longer build the fips provider and the fips
provider build process (including sources) is very prescribed to
specific build steps and source versions, there's no reason why we need
to continue carrying around this diff anymore.

MFC after:      1 week
Signed-off-by: Enji Cooper <ngie@FreeBSD.org>

  [ToolChains][FreeBSD] Set default Linker to LLD for FreeBSD (#190596)

  When the linker is specified as ld, toolchain applies special handling
  by invoking (triple)-ld instead of resolving ld via standard PATH
  lookup. This causes GNU ld installed via the system package manager to
  take the precedence (since (triple)-ld appears earlier in the search
  path), effectively overriding ld.lld.

  As a result, we set the default Linker on FreeBSD to ld.lld to indicate
  we want to use lld by default.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292067
MFC after:      3 days

Amongst others mt76_connac_pm_unref() is calling mt76_connac_power_save_sched()
which will (normaly) re-schedule the pm_work.
In various parts we also cancel that work, also during PCI detach ("shutdown",
"remove" in LinuxKPI terms).
However we also keep calling mt76_connac_pm_unref() in the detach path and thus
we get to a point where we re-scheduled the work but then the device goes away.
At that point LinuxKPI delayed work has a callput pending which is embedded in
the work structure (pm_work).  The moment we free the device that structure
and callout is gone but the callout is still on the list and once that list
is walked we panic.

Simply prevent mt76_connac_power_save_sched() from getting to the point of
possibly re-scheduling the pm_work by setting pm->enable to false in the
beginning of the detach path.

The are likely more paths which will need the same treatment as the code
is by far anything from "symmetric" (that is the attach path is highly
bus independent while the detach path is implemented per-bus).  Also
other chipsets share the same "logical paths" with their own names, so
they will need this too once we get to them.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

mt76: ensure net80211 com instance before returning from driver load

Do as we have done for iwlwifi (f808c43ad923,  bee60c989745) add a
completion event for device registration which calls into 802.11
and creates the wifi "device" (net80211 com instance).
This is needed as otherwise the deferred work in the mt76 drivers
(mt7915, mt7921, mt7925, mt7996; but not the 7615 [*]) would make
driver loading return before the wifi device is there.  We would then
continue, e.g., during rc startup and race possibly trying to create
a vap (wlan interface) with the underlying device not being registered
yet and fail.

[*] the 7615 does not seem to do this asynchronously so is fine.

Sponsored by:   The FreeBSD Foundation
Tested on:      7921, others to be tested at time
MFC after:      3 days

mt76: mt7921: terminate fw log messages with \n

In order to make the firmware messages spewed on the console readable
write one message per line and not one very long line.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

mt76: mt7921: depend on lindebugfs and turn debugfs support on

Add the missing MODULE_DEPEND() calls for lindebugfs.
It is unfortunate that they are shared code between various bus
implementations.  Ideally we would leave the MODULE_DEPEND() calls
in the debugfs.c file instead of adding extra #ifdef guards to the
bus attachment files.

Turn debugfs support on for mt76(core) and the mt7921 module for now.

Sponsonred by:  The FreeBSD Foundation
MFC after:      3 days

improve renice user error messages

Improve error handling for invalid user names and UIDs in renice:
- Use warnx() and err() for consistent error reporting
- Set errno = EINVAL for invalid input
- Provide clearer error messages for invalid user names and UIDs
- Add test cases for invalid user input

Signed-off-by: androvonx95 <androvonx95@tutamail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1768

Revert "improve renice user error messages"

This reverts commit 925f53682469ea12c017b48114b16e8f1627fb0b. The tests are wrong,
so I'm reverting and reopening the pull request.