This is a display of mostly-automatically-classified git commits from 2026-06-29 to 2026-07-05.
Table of contents and commits per category:
| (1) | Highlighted commits (these are copies, not in stats) | |
| 0 | 0.0% | Userland programs |
| 3 | 2.1% | Documentation |
| 18 | 12.6% | Hardware support |
| 10 | 7.0% | Networking |
| 7 | 4.9% | System administration |
| 10 | 7.0% | Libraries |
| 6 | 4.2% | Filesystems |
| 26 | 18.2% | Kernel |
| 3 | 2.1% | Build system |
| 3 | 2.1% | Internal organizational stuff |
| 10 | 7.0% | Testing |
| 3 | 2.1% | Style, typos, and comments |
| 5 | 3.5% | Contrib code |
| 39 | 27.3% | Reverted commits |
| 0 | 0.0% | Unclassified commits |
| 143 | 100% | total |
| Technical notes about this page |
For extra visibility, these are copies of commits found in
other sections. Most (if not all) come from the commit message
containing "Relnotes:", or commits modifying
UPDATING.
TLS receive offload is really only beneficial for in-kernel use cases (such as NFS over TLS) or when using a hardware offload. In addition, several recent SAs have involved the TLS receive path, but the only current mitigation for those is to disable TLS offload entirely. Reviewed by: ziaee, gallatin, markj Relnotes: yes Sponsored by: Netflix Sponsored by: Chelsio Communications Co-authored-by: John Baldwin <jhb@FreeBSD.org> Differential Revision: https://reviews.freebsd.org/D57974
Commits about commands found in man section 1 (other than networking).
-- no commits in this category this week --
Man pages, release notes, etc.
Sponsored by: The FreeBSD Foundation MFC after: 3 days
Import the ENVIRONMENT section from NetBSD, minus the variable that our ctfmerge does not have. Alphabetize them, polish grammar and alignment, and add the variables to the man database. While here, remove whitespace from the end of some lines to quiet linter. MFC after: 3 days PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291186 Co-authored-by: Alexander Ziaee <ziaee@FreeBSD.org> Obtained from: NetBSD (christos <christos@NetBSD.org>, 8a0c0d8) Differential Revision: https://reviews.freebsd.org/D54054
While here, remove the long-unused dash in the first line. Reviewed by: ziaee, olce Fixes: https://cgit.freebsd.org/src/commit/?id=ddf144a04b53 ("ps.1: Revamp: Explain general principles, update to match reality") MFC after: 1 day Differential Revision: https://reviews.freebsd.org/D58038
Hardware drivers and architecture-specific code.
This subclass declares its own softc structure adding necessary members after the embedded ehci_softc_t. The full size of the struct must be included in the driver declaration, otherwise the allocation backing the softc is not guaranteed to be large enough. Reported by: KASAN Reviewed by: jrtc27, manu Fixes: https://cgit.freebsd.org/src/commit/?id=7a58744fd0f1 ("Split out the attachment from the generic-ehci driver") MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57951
Prometheus doesn't allow spaces, let's normalize this to what we use elsewhere for consistency. The sysctl exporter could probably do this itself, but let's decouple that from the immediate problem: matching the label between the exported data and in-tree is nice for greppability. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296179 Reviewed by: asomers, wulf Differential Revision: https://reviews.freebsd.org/D57966
asmc: try PIO before MMIO to avoid false T2 detection Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to expose the T2 system state register and Mac board identifier via SMC. Try PIO access before MMIO during probe to prevent false T2 detection on Macs that happen to have something mapped at the T2 BAR address. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57844
asmc: add system state and board identity sysctls Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP), thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS), board_id (RPlt), and chip_gen (RGEN). Each sysctl is registered only if the key exists on the hardware. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57853
asmc: deduplicate sensor converters and cause sysctls Replace per-type spXX_to_milli() functions with a table-driven asmc_sensor_convert() that looks up the divisor by SMC type string. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57854
Book-E powerpc has 64-bit bus_addr_t but only a 32-bit bus_size_t. Use the right macros for maxsize and maxsegsize to fix the build. Fixes: https://cgit.freebsd.org/src/commit/?id=4bf8ce037 ("if_rge: initial import of if_rge driver from OpenBSD.") Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57794
Depend on clknode_if.h in the module Makefile, so that it gets explicitly built for the module. Also, reduce the #if guards to only the new clock output code, and gate them on all powerpc, not just powerpc64. Fixes: https://cgit.freebsd.org/src/commit/?id=6b77d34f ("HYM8563: Add support for clock output.") Reviewed by: mmel Differential Revision: https://reviews.freebsd.org/D57795
These were added during the DPAA driver rewrite, and should not have gone in then. Remove them.
Reviewed by: mav Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58003
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199101 MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57929
MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D57930
Some firmware delivers the power or sleep button press that woke the system as an ordinary button press (Notify 0x80) shortly after resume, rather than as the wakeup notification (Notify 0x02) the ACPI specification requires for a button that is also a wake source. On affected machines (e.g. the Framework Laptop 12, Intel Raptor Lake-P) the power button is a control-method device behind the embedded controller. The EC latches the key press that woke the system across the sleep transition and flushes it through its normal _Qxx query path as soon as it is reinitialized on resume. The replayed press is indistinguishable from a genuine one, so the kernel honors it as a fresh suspend request and the machine suspends again immediately after waking; it cannot be kept awake with the button. The event cannot be filtered at its source: it arrives over the same EC query path that also carries legitimate events (lid, AC, thermal, battery), so suppressing the drain would lose real notifications. Instead, record the time of resume and ignore a button-initiated suspend that arrives within a short grace window of it. The timestamp is taken before DEVICE_RESUME() re-initializes the EC, so it is set before the replay can be processed on the ACPICA notify taskqueue; otherwise the replay can be evaluated before the timestamp is written and slip through. Measured from that point, the replay lands at ~600 ms across many cycles on a Framework Laptop 12, whereas a deliberate press cannot occur that quickly -- it happens well after the display is back -- so a one-second window separates the two without ignoring real presses for any perceptible time. Spec-compliant firmware reports the wake as Notify 0x02, which is handled on a different path and never reaches this check, so there is no change in behavior on such systems. The replay window is a fixed compile-time constant rather than a tunable on purpose: it tracks a hardware characteristic -- the EC's post-resume replay latency -- not a user policy, so there is no value a user would meaningfully choose. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296243 Reviewed by: adrian, imp (earlier revision), olce MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D57712
Also, add a check in the attach method that a per-CPU structure is provided by the bus. This allows to remove such checks in multiple functions. The check cannot currently fail as all x86 CPU drivers (ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is safer to have it, especially as an example to other driver writers. Event: Halifax Hackathon 202606 Location: Seat 36K in AC667, still waiting for a gate at Montréal-Trudeau Sponsored by: The FreeBSD Foundation
Also, add a check in the attach method that a per-CPU structure is provided by the bus. This allows to remove such checks in multiple functions. The check cannot currently fail as all x86 CPU drivers (ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is safer to have it, especially as an example to other driver writers. Event: Halifax Hackathon 202606 Location: Seat 25A in AF0349, before leaving Montréal-Trudeau Sponsored by: The FreeBSD Foundation
This fixes associating to various APs. It worked fine to a FreeBSD AP (which is a wholly separate problem I'm going to need to dive into) but not to my tplink AX1800 Wifi-6 router. PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296503 Locally tested: * STA: Intel Centrino Advanced-N 6205 (iwn), Lenovo T420 * AP: TP-Link AX1800 wifi-6 router
M_PREPEND in the broadcast branch may call m_prepend(9) which allocates a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the old mbuf. xfer->mbuf was set before M_PREPEND, so it pointed at the deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and panics. Reviewed by: zlei, adrian Differential Revision: https://reviews.freebsd.org/D57495
Network-related commands, library, and kernel.
No functional change intended. Reviewed by: tuexen MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57945
This "interface" type is no more. Leave the constant in if_types.h, we probably need an exp-run before removing it.
Suggested by: pouria, glebius
Sponsored by: Rubicon Communications, LLC ("Netgate")
In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753
Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791
Update ieee80211_crypto_init_aad() to do what 802.11-2020 says - only mask fc[0] bits 4-6 on data frames, not on management frames. This (with other diffs to actually negotiate MFP and configure ath(4) for MFP + software keys) allows the CCMP path to decrypt CCMP MFP frames in the software path. Differential Revision: https://reviews.freebsd.org/D57799
There is no visible bug fixed as in current tree masks are the same. Fixes: https://cgit.freebsd.org/src/commit/?id=6883b120c53735ff1681ef96d257f376731f56b3
Add const-qualified versions of the NLA iteration helpers to allow walking immutable netlink attribute buffers without discarding const qualifiers. This introduces NLA_NEXT_CONST(), _NLA_END_CONST(), and NLA_FOREACH_CONST() in netlink_snl.h. Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com> Sponsored-by : Google LLC (GSoC 2026)
Record the Netlink protocol associated with AF_NETLINK sockets when they are created and pass it to libsysdecode during message decoding. Use the protocol to distinguish between Generic Netlink and Route Netlink sockets, ensuring that Generic Netlink decoding is only performed for NETLINK_GENERIC sockets. Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com> Reviewed by: kp Sponsored-by : Google LLC (GSoC 2026)
Stuff in man section 8 (other than networking).
rtld: add spinlock around the crt malloc calls Right now, the rtld malloc is called under the write-locked rtld bind lock. A future change adds places where only read-locked rtld bind lock is held, and then the spinlock protects the malloc structures from the parallel updates. Reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
rtld: stop using unbound alloca() For DoneList allocations, its size depends on the number of loaded DSOs. Small images could be served by alloca(), but large donelists need to go into heap. For map_object(), alloca size is the number of segments in the object. In both cases, over-grown situations would cause a stack overflow. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991 Noted and reviewed by: kevans Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
rtld: unify the return path for map_object() Reviewed by: kevans Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57908
The shadow buffer is addressed relative to `tg_origin`, which includes the padding offset, whereas `gfxfb_blt` operates on coordinates without that offset. To make `gfx_fb_copy_area` emulate the behavior of `gfxfb_blt`, the source coordinates must include the padding offset, while the destination coordinates must not. The original implementation omitted the offset from the source coordinates; this change corrects that. Additionally, `gfx_fb_cons_display` already applies the padding offset, so the redundant adjustment is removed. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296246 Reported by: 2khramtsov@gmail.com Reviewed by: imp Tested by: 2khramtsov@gmail.com, junchoon@dec.sakura.ne.jp, naito.yuichiro_@gmail.com Fixes: https://cgit.freebsd.org/src/commit/?id=32da2f23ae4d MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57821
Since syslogd was converted to run in a Capsicum sandbox, it needs to explicitly connect() its forwarding sockets rather than using sendmsg(). At the time syslogd starts during boot, some of its forwarding destinations may not be routable, in which case connect() fails. Fix this by making connect() failures non-fatal, and use cap_net to lazily connect sockets once something actually tries logging to the destination. Add a regression test. Reported by: ae Reviewed by: ae Discussed with: jfree Fixes: https://cgit.freebsd.org/src/commit/?id=4ecbee2760f7 ("syslogd: Open forwarding socket descriptors") MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D57394
When pinning a vcpu to a hostcpu fails, print out a diagnostic message to stderr indicating the failing CPU pair. MFC after: 1 month Reviewed by: bnovkov Differential Revision: https://reviews.freebsd.org/D57619
The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283934 Reported by: crest at rlwinm.de
Sponsored by: The FreeBSD Foundation MFC after: 1 week
Reviewed by: kevans Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57955
Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947
wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949
Fixes: https://cgit.freebsd.org/src/commit/?id=255538cd906045095d0c2113ae6c4731ce36c0cf Differential Revision: https://reviews.freebsd.org/D57850 Reviewed by: adrian
MFC after: 1 week Fixes: https://cgit.freebsd.org/src/commit/?id=c3276e02beab ("sockets: make shutdown(2) how argument a enum") Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D57915
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296410 Submitted by: Tomas Vondra <tomas@vondra.me> MFC after: 1 week
libsysdecode: decode Generic Netlink controller messages Decode Generic Netlink controller (GENL_ID_CTRL) messages in Netlink payloads. Display the Generic Netlink header along with the CTRL_CMD_GETFAMILY attributes, including the family ID and family name. Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com> Reviewed by: kp Sponsored-by: Google LLC (GSoC 2026)
libsysdecode: cache Generic Netlink family IDs Record Generic Netlink family IDs learned from CTRL_CMD_GETFAMILY responses and use them to decode subsequent Generic Netlink messages using symbolic family names instead of numeric IDs. Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com> Reviewed by: kp Sponsored-by: Google LLC (GSoC 2026)
libsysdecode: decode PF Generic Netlink commands Decode the Generic Netlink command header for messages belonging to the PF Generic Netlink family. Display the command name using the PF Generic Netlink command decoder. Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com> Reviewed by: kp Sponsored-by: Google LLC (GSoC 2026)
Rename am_lock description from autofslk -> autfsm. The lock description, autofslk, is used as the description for autofs_softc->sc_lock, which is used to protect autofs requests and the like as opposed to am_lock which protects autofs nodes for a given mount. This change allows witness to distinguish different lock orders for each lock. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D57972
The OpenZFS merge 80aae8a3f8aa introduced HAVE_SIMD() which checks for HAVE_TOOLCHAIN_* defines via simd_config.h. The kernel module Makefile was updated, but kern.pre.mk (static kernel build) and the libzpool/libzfs Makefiles were missed, still using the old HAVE_SSE2 etc. names. This caused all vectorized raidz, fletcher, and blake3 implementations to be compiled out.
The consequences are: - for nfs exports and fhopen(2), unlinked but still referenced inodes are accessible - for ffs_vput_pair() with unlock_vp = false, spurious ESTALE is not returned when the inode is still alive but unlinked Note that tmpfs does not return ESTALE for the unlinked nodes. The same behavior is claimed for Linux in https://github.com/openzfs/zfs/issues/18699 Reviewed by: rmacklem Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57982
Fix two locking violations that could happen during execve, while
executing a file stored on fusefs. Both would cause panics on an
INVARIANTS kernel after 15.0, or a DEBUG_VFS_LOCKS kernel prior to that.
Neither is likely to be noticeable on a release kernel.
* Don't assume that the vnode is exclusively locked during VOP_CLOSE.
It usually is thanks to !MNTK_LOOKUP_SHARED, but isn't during execve,
which locks the vnode outside of the lookup path.
* Totally rewrite fuse_io_invalbuf. It's had a number of problems ever
since its original introduction[^1]:
- Don't assume that the vnode is exclusively locked. That assumption
failed during execve just like the assumption in fuse_vnop_close.
- Don't livelock forever if vinvalbuf returns ENOSPC or EDQUOT.
- Don't attempt to handle multiple threads calling this function at
the same time. That would be impossible if the vnode truly were
exclusively locked. So the code was dead. Or it would've been, if
the assumption hadn't been wrong. Furthermore, both vinvalbuf and
vnode_pager_clean_sync only require a shared vnode lock, and are
already capable of dealing with multiple simultaneous callers.
- Using fvdat->flag in this way would require some sort of mutex
protection, if the vnode weren't exclusively locked.
* Add new test cases that trigger both of the aforementioned panics.
[^1]: https://github.com/glk/fuse-freebsd/commit/efe6eb3005e7633b4e31d5e453eacbaa0cba42fa
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295957
Reported by: dan.kotowski@a9development.com
MFC after: 2 weeks
Sponsored by: ConnectWise
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57536
Previously, an_vnode_lock was initialized with SX_NOWITNESS to silence
lock order reversals. The reversals would occur when autofs_node_vn()
was called with the directory vnode lock held, then lock an_vnode_lock,
then lock the vnode attached to the autofs node. It looked like:
directory vnode -> an_vnode_lock -> vnode attached to autofs node
The established lock order is now vnode -> an_vnode_lock
Currently, we don't have to worry about losing an autofs node during the
unlock/lock as autofs nodes are only removed during an unmount() after
vflush(). When autofs_node_vn() is called, the mountpoint has either
been busied (preventing unmount) or a directory vnode is locked which
prevents vflush() from finishing until the directory vnode is unlocked.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D57857
Commit 016570c4463d modified the client to handle the upgrade of a read delegation to a write delegation, where the server provides the same delegation stateid to the client. However, it failed to check if the delegation structure was currently in use. Without this patch, if the structure was in use, a use after free could occur. This patch handles the "in use" case by copying the necessary fields into the current/old structure and free's the new one instead of the old one that is "in use". PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296224 MFC after: 2 weeks
Kernel stuff (other than networking, filesystems, and drivers).
These provenance-preserving functions are to be used when copying objects that are expected to contain pointers. Data buffers which do not contain pointers should be copied by the traditional copyin/copyout functions which *do not* preserve pointer provenance (on CHERI they clear validity tags). NOTE: Going forward, this requires changes when adding new syscalls or ioctl that take pointers to objects containing pointers. Fortunately, the vast majority (>90%) of copyin and copyout statements do not copy pointers and require no change. Failure to make the chance will have no effect on non-CHERI architectures. Reviewed by: kib, markj Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57663
CHERI: declare fueptr and suptr These should replace fueword and suword when manipulating pointers in memory. On CHERI targets they will be implemented using capability aware instructions and otherwise they are defined to fueword and suword. Reviewed by: kib, markj Effort: CHERI upstreaming Sponsored by: Innovate UK Differential Revision: https://reviews.freebsd.org/D57664
fetch.9: fix a typo Fixes: https://cgit.freebsd.org/src/commit/?id=a1c52e05f571 ("CHERI: declare fueptr and suptr") Effort: CHERI upstreaming Sponsored by: Innovate UK
Harden witness against reasonable tunable settings causing boot panics or scribblers. For now, don't bother to harden this completely. Panics are still achievable by setting the tunables to negative or very large values. The recent change to respect the setting of debug.witness.witness_count (08180f1b613b) exposed that there are no guard rails on that setting, setting it to large but plausible values can cause integer overflow or cause attempted use of memory beyond what is actually available. Add some guard rails, fall back to default configuration if the tuned values are too large, and fall back to a minimum memory allocation if even the defaults are too large. Also don't allow witness to use over half of the memory segment, as there are other early allocators after witness too. Reported by: asomers Reviewed by: kib, markj (previous version) Fixes: https://cgit.freebsd.org/src/commit/?id=08180f1b613b ("witness: actually set read-only tunables in time for witness_startup") Sponsored by: Dell Inc. Differential Revision: https://reviews.freebsd.org/D57793
Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743
The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790
posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies <chrisjd@openai.com> Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830
posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies <chrisjd@openai.com> Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831
posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies <chrisjd@openai.com> Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832
`error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847
If an mbuf in the chain was skipped because it only contained bytes
from the header, the iovec index ('i') was incremented even though the
entry was not populated. Only increment 'i' when an iovec entry is
consumed.
Add a new type of KTLS receive test which writes a single TLS record
via two separate write(2) calls over a TCP_NODELAY socket to trigger
a split in the mbuf chain in the kernel. Test various split locations
including after the "plain" TLS header (5 bytes), after the full TLS
header, in the middle of the data payload, just before the start of
the trailer, and in the middle of the trailer. These tests are also
run against all supported ciphers, not just CBC. The 'header' test
for CBC ciphersuites was able to trigger the bug.
Approved by: so
Security: FreeBSD-SA-26:46.ktls
Security: CVE-2026-49423
Sponsored by: Chelsio Communications
If an mbuf's length in the chain for an encrypted TLS record exactly matches the remaining length of header bytes to skip, skip the mbuf entirely rather than adding a zero-length iovec entry. Sponsored by: Chelsio Communications
Attempting to handle the error gracefully can easily result in missing
SIGSYS, so this was made to always succeed in
39024a89146 ("syscalls: fix missing SIGSYS for several ENOSYS errors")
and returns the nosys entry on failure.
Drop the pretense of returning an error and clean up a few dead error
paths.
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D57848
Move the check out of ktls_enable_(rx|tx) and into ktls_create_session. Reviewed by: gallatin, markj Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D57973
TLS receive offload is really only beneficial for in-kernel use cases (such as NFS over TLS) or when using a hardware offload. In addition, several recent SAs have involved the TLS receive path, but the only current mitigation for those is to disable TLS offload entirely. Reviewed by: ziaee, gallatin, markj Relnotes: yes Sponsored by: Netflix Sponsored by: Chelsio Communications Co-authored-by: John Baldwin <jhb@FreeBSD.org> Differential Revision: https://reviews.freebsd.org/D57974
linuxulator: Fix O_PATH file descriptors errno for f*xattr(2) LTP open13 expects these operations to fail with EBADF, matching Linux behavior, but FreeBSD currently returns EOPNOTSUPP for fgetxattr() on an O_PATH fd Look up Linux fd-based xattr descriptors with getvnode() and route the operations through shared kern_extattr_*_fp() helpers so the O_PATH check and the extattr operation use the same referenced file. Apply the same EBADF handling to fsetxattr(), fremovexattr(), and flistxattr() so the xattr paths stay consistent. Signed-off-by: YAO, Xin <mr.yaoxin@outlook.com> PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295537 Reviewed by: kib Pull Request: https://github.com/freebsd/freebsd-src/pull/2263
linuxulator: Fix operator precedence for LINUX_XATTR_FLAGS in setxattr() The LINUX_XATTR_FLAGS macro expands to (LINUX_XATTR_CREATE|LINUX_XATTR_REPLACE). Without parentheses around the macro expansion, the bitwise & operator has higher precedence than |, causing incorrect flag evaluation and a compiler warning. Add the missing parentheses around LINUX_XATTR_FLAGS to ensure correct operator grouping, matching the existing usage in getxattr(). Signed-off-by: YAO, Xin <mr.yaoxin@outlook.com> Fixes: https://cgit.freebsd.org/src/commit/?id=2c905456312b ("linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)") Reviewed by: kib Pull Request: https://github.com/freebsd/freebsd-src/pull/2306
Move the atomic size-probe-and-read logic into a new linux_extattr_get_vp() function in linux_xattr.c instead of modifying the generic extattr_get_vp() in vfs_extattr.c. This keeps Linux-specific getxattr semantics (ERANGE on too-small buffer, EOPNOTSUPP to ENOATTR mapping) self-contained within the linuxulator. The function probes the attribute size and reads the data under a single vnode lock, preventing a TOCTOU race between the size probe and data read. Signed-off-by: YAO, Xin <mr.yaoxin@outlook.com> Reviewed by: kib Pull Request: https://github.com/freebsd/freebsd-src/pull/2263
CHERI: declare mem{cpy,move}_data
Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices). On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance. This reduces the risk of accidental spread of
pointers on CHERI systems.
Document that bcopy preserves pointer provenance.
Reviewed by: ziaee, kib, adrian, markj
Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL, Innovate UK
Differential Revision: https://reviews.freebsd.org/D57662
CHERI: add sooptcopyinptr to preserve pointer provenance Most socket options don't involve pointers so make the default sooptcopyin discard provenance and add a sooptcopyinptr that preserves. Reviewed by: markj, emaste Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57665
CHERI: make mem{cpy,move}(9) CHERI compatible
- Use intptr_t in place of long as the word type in the core copying
loop where aligned words a copied. This preserved the provenance of
any copied pointers.
- When working with the address of src or dst use ptraddr_t rather than
uintptr_t. This avoid ambigious provenance in expressions involving
multiple addresses.
As a minor tweak, rename the function to memmove since that is the
interface it implements (overlapping src and dst are permitted) and make
memcpy the alias rather than the other way around.
Reviewed by: kib, markj
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D57965
Fixes: https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket") Reviewed by: glebius MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57967
Attaching to a jail changes its root directory and its process credentials. These operations both require unlocking the jail, and also need allprison_lock unlocked. That means that if two threads are trying to attach to different jails at the same time, it's possible for the process to end up with one jail's root directory but the other jail's credentials. Solve this by forcing the process into single-threaded mode during system calls that attach to a jail (jail_attach, jail_attach_jd, and sometimes jail_set). Reviewed by: kib, markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D57858
If git is installed and .git exists but git rev-parse failed to report a hash we previously produced just "-dirty" as the git revision. Gate the git commit count and -dirty check on the rev-parse passing. Reviewed by: jlduran Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57995
It is a handy shortcut that will be used extensively in hwpstate_intel(4) and hwpstate_amd(4). Warn users that it panics if the parent bus does not provide the CPU_IVAR_PCPU instance variable. That condition should be tested by callers (doing so once is enough). Suggest to do that in driver's attach method. Reviewed by: jhb (code) Event: Halifax Hackathon 202606 Location: Seat 36K in AC667, waiting for a gate at Montréal-Trudeau Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57897
This makes the header more self-contained. The symbol is needed only on 32bit arches, but the include file is provided unconditionally to make the namespace population predictable. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296489 Sponsored by: The FreeBSD Foundation MFC after: 1 week
The header files for dialog, figpar, dpv were never listed. Fixes: https://cgit.freebsd.org/src/commit/?id=bc6c827078b7 ("OptionalObsoleteFiles: Add figpar to dialog section")
This update brings spdxtool(1), with the ability to generate software bill of material files (SBOM) in the SPDX 3.0.1 format (JSON-LD). Reviewed by: markj Approved by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57953
We have separate ports for Ccache 3 and 4. Suggest both, rather than only the Ccache 3 port. Rearrange the text somewhat to avoid an excessively ragged edge on a standard 80-column terminal. MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58005
This is a utility that effectively wraps git-cherry-pick for performing MFCs, though it has some other usages. In addition to actually cherry-pick the specified commits, it looks at the upstream branch for fixup commits, denoted by a `Fixes:` tag which references the fixed commit. Aside from actually cherry-picking commits, git-mfc can also be used to list pending MFCs (commits in the upstream branch which are eligible for MFC based on the `MFC after` tag), and "dangling" MFCs, where a commit was MFCed to the currently checked out stable branch, and the upstream branch has one or more fixup commits which have not been merged. The utility requires python and the gitpython module. Reviewed by: des Differential Revision: https://reviews.freebsd.org/D57845
This completes step 5 from Committer's Guide. Approved by: jbo (mentor) Differential Revision: https://reviews.freebsd.org/D57934
Previously, these tests expected the bell chars to arrive before the initial status line. This appeared to be ok because ping(8) incorrectly mixed unbuffered and buffered writes by using printf(3) calls for the initial status, but direct write(2) calls for the bell chars. 141bb85798 revealed that the test's assertions only passed because the buffered writes did not get flushed before the direct writes in the test runs. 8bda488114f3 fixed ping(8) to use POSIX stdio buffered writes in all cases and guarantee a deterministic output ordering to stdout observers. This patch fixes the test to match the correct ordering. Reviewed by: des Sponsored by: The FreeBSD Foundation
This is a distillation of the environment described in the PR, using a dummy shlib and mapping it repeatedly. This takes advantage of the guard page added in 2767a1f3686e5b16 to reliably crash if rtld tries to scale its stack usage excessively with the # DSOs loaded. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991 Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D57954
Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747
There is no functional change for existing tests, but allows to write a test that would expect an immediate success of bind(2).
- Test SOCK_DGRAM (UDP) sockets. - Test binding to 0:port and to a addr:port in presence of connected socket using the port. Differential Revision: https://reviews.freebsd.org/D56707
Just avoid repeating the test program name in every test case name. No functional change. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56727
This fixes an endianness bug in sys/netinet/ip_reass_test. Just use the code from RFC 1071. Reported by: glebius Reviewed by: glebius, Timo Völker MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D57988
/sbin/ping and /sbin/ping6 are hard-linked, and the vmmap sysctl handler doesn't know which name was used to launch the process. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296116 MFC after: 3 days Fixes: https://cgit.freebsd.org/src/commit/?id=080a4087014e ("tests: Fix race condition in aslr_setuid")
MFC after: 1 week
These could go in other categories, but it's more clear if they're here instead.
MFC after: 3 days Reviewed by: bz, ziaee Fixes: https://cgit.freebsd.org/src/commit/?id=0a2f7683bf0c ("man: iwlwifi/rtw88/rtw89: update man pages for Linux v7.0 based updates") Differential Revision: https://reviews.freebsd.org/D57720
Fix small typo in pf.conf(5) MFC after: 3 days Reviewed by: ziaee Differential Revision: https://reviews.freebsd.org/D57938
The flag is -D, but it was written as a second -d. Add a period too. MFC after: 3 days
Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948
In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950
This automatically computes the correct PKG_CONFIG_PATH with LOCALBASE from the environment (when set) or from the "user.localbase" sysctl, in this order. Reviewed by: des Approved by: des Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57246
Merge commit 'e988c5eab5231646c612d35ff5b16122cebfbf6a'
resolver(5): Overhaul * Modernize the markup * Describe the comment syntax * Drop obsolete advice * Capitalize sentences * Improve the language * Replace no_tld_query with no-tld-query; both are supported, but all the other multi-word options use hyphens rather than underscores. * Add missing ENVIRONMENT section * Redo the example MFC after: 1 week
Revert "resolver(5): Overhaul" This reverts commit 066bef580b21bed9100c727045e1dbfdeb9bf1a9.
libc/resolv: Drop Solaris 2 compatibility MFC after: 1 week
Revert "libc/resolv: Drop Solaris 2 compatibility" This reverts commit b27e21f304f260d539288756c5bb85421a549d44.
libc/resolv: Refactor the option parser Start the loop by finding the end of the option name, the name-value separator (if any), and the end of the option. Use those pointers to simplify matching the option name and parsing the option value. This means that: * We no longer accept trailing garbage in an option name or value. For instance, we would previously interpret “edns0123” as “edns0” and “timeout:3xyz” as “timeout:3”. This was actually quite lucky because we also failed to recognize the newline at the end of the option line as a whitespace character. * For options that take a numerical value, we would previously happily set a numerical option to a negative value and treat non-numerical arguments as 0, while a numerical argument that happened to exceed the maximum for the option would result in the option being set to its default value. Now, any failure to parse the argument, including overflow, results in the option being set to its default value. MFC after: 1 week
Revert "libc/resolv: Refactor the option parser" This reverts commit 40e10af6c6dc46d9c0835db3dc95368ce7d69b55.
libc/resolv: Refactor the configuration parser This was previously all a single loop in res_init(), apart from option parsing which we cleaned up in a previous commit. Break it out into separate functions for reading the configuration line by line, setting the default domain, setting the search list, and adding a nameserver to the nameserver list. Sprinkle bounds checks and code comments all around. The sortlist code, which has been disabled for the past 20 years, will be dealt with in a separate commit. MFC after: 1 week
Revert "libc/resolv: Refactor the configuration parser" This reverts commit 9fd22951233219b5e9985575c1b3aaf3532961fd.
libc/resolv: Reimplement the sortlist parser When we switched from the BIND4 resolver to the BIND9 resolver, the sortlist parser was inadvertently disabled, and nobody noticed. The sorting code remained enabled in the resolver, but there was no way to set a sort order. Reimplement the sortlist parser, but correctly, and update the documentation accordingly. The new parser accepts IPv4 and IPv6 addresses with or without a prefix length. Fixes: https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.") Relnotes: yes
Revert "libc/resolv: Reimplement the sortlist parser" This reverts commit 507ab02d751b4aaa7f35f30882299e9908448e53.
libc/resolv: Add no-debug and no-rotate options These are simply the reverse of the debug and rotate options.
Revert "libc/resolv: Add no-debug and no-rotate options" This reverts commit 61697e9cd5cccc367a38f9851efebad4d7c2bb65.
resolv.h: Remove unused parts
Revert "resolv.h: Remove unused parts" This reverts commit 95978326cb326c69592c75323914bdc52ada0346.
libc/resolv: Dead code and style cleanup
Revert "libc/resolv: Dead code and style cleanup" This reverts commit 5028a8489f54fcf0a96399059c14e28c6a69d159.
libfetch: Overhaul socket read / write * Make fetch_ssl_read() and fetch_ssl_write() behave more like read(2) and write(2), and drop fetch_socket_read() in favor of read(2). * Don't request POLLERR, it's implied. * Don't needlessly set errno, it's relatively costly. * Always check for EAGAIN from writev(2), otherwise we will abort on a short write instead of proceeding to poll(2). * Always check for EAGAIN from poll(2) even though it can't happen on FreeBSD; POSIX says it can, and it might in the future. * Rewrite fetch_read() and fetch_writev() to be more similar to each other. The main difference is that a partial read is treated as success while a partial write is treated as failure. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296316 MFC after: 1 week
Revert "libfetch: Overhaul socket read / write" This reverts commit 298f37a71ae6d9f2cb0c2abd4ff2887e81e0942c.
libfetch: Add read buffering Previously, we would read FTP control connection messages and HTTP reponse headers one character at a time. Now, we read as much as will fit in our buffer and look for a newline. If there is data left over, it will be reused by the next fetch_getln() call. This also requires the addition of a fetch_bufread() which takes the buffer into account, otherwise the start of the HTTP response body will be stuck in the buffer after we read the last line of the header. This should noticeably improve HTTP performance, especially for small transfers. MFC after: 1 week
Revert "libfetch: Add read buffering" This reverts commit afb60498e0c9836a6e3a7efda8a51710e208a608.
libfetch: Apply timeout to connection attempts Mark the socket non-blocking before connecting and poll for completion, applying fetchTimeout if set. MFC after: 1 week
Revert "libfetch: Apply timeout to connection attempts" This reverts commit d53af4112273f7b234a1cdd6694b3a7ca0aae0eb.
libfetch: Document fetchTimeout Document the global fetchTimeout variable, now that it works reliably. MFC after: 1 week
Revert "libfetch: Document fetchTimeout" This reverts commit c83e9ee0ef3e6af982e6fd35afe420d460fa84b3.
fetch: Stop setting an alarm Now that fetchTimeout works reliably, setting an alarm is not only no longer necessary but counterproductive, as it will trigger even if the connection is not actually stalled but merely slow. While here, improve the wording of the manual page's description of the various options for setting a timeout. MFC after: 1 week
Revert "fetch: Stop setting an alarm" This reverts commit 23380f3e6ac9334e85489f92f7f20b700ede3368.
libfetch: Make fetch_ref an inline Make fetch_ref() an inline and provide a fetch_deref(). MFC after: 1 week
Revert "libfetch: Make fetch_ref an inline" This reverts commit 672cb7320a2754788bddf5cd026721b6f70a0d30.
libc/resolv: Export __res_conf_name Add a new global variable, __res_conf_name, which is initialized to _PATH_RESCONF and used in its place by res_init(). This allows test programs (and applications) to select a different configuration file to read instead of /etc/resolv.conf. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220610
Revert "libc/resolv: Export __res_conf_name" This reverts commit 702c24ccc0c208e9bc697e775abe47ff723e3012.
pkgbasify: Add new utility The pkgbasify utility converts a system installed from distribution sets to packaged base by registering, without actually installing, a set of packages that corresponds to what is already installed. MFC after: 1 week
Revert "pkgbasify: Add new utility" This reverts commit e6467516f584505ac29fd370966abd530a7b5454.
Retire dialog This is the last remaining piece of GPL software in the base system. The installer transitioned to bsddialog four years ago, and the last remaining dialog consumer, dpv, was turned off more than two years ago. Retire dpv, libdpv, libfigpar (used only by dpv), and dialog itself. (cherry picked from commit 73bb4a92985d747462d866248c1e7623f7ff1a7f)
Revert "Retire dialog" This reverts commit 5b2bdadeb6c25c10dac9722fd66a668e14d3b384.
Retire the GNU subtree With GNU diff and cdialog gone, this is now an empty shell. (cherry picked from commit 151dd62e005119dda24b8ff9b14aa5beaaa681ac)
Revert "Retire the GNU subtree" This reverts commit 9cc87ca23d9ccae814bea514aa4bdc791f2d6e46.
This reverts commit 5b8c28adb829b50fb8ac065637fa99f717858bab. The commit message was wrong. Reported by: des
zfs: Wire sha512 offload to the build FreeBSD main just got the CPUID_STDEXT4_SHA512 define. OpenZFS PR #18732
Revert "zfs: Wire sha512 offload to the build" This reverts commit cd61eb4f6681b13d98b6a7be252500ad30f05f74. Some people report module load failure due to undefined symbol. I don't have those problems myself, so it might be a question of full rebuild. But I don't have time right now, so just revert.
Not classified automatically, and waiting for manual attention.
-- no commits in this category this week --
Dates:
cgit.freebsd.org/src. Git accurately records the
order of commits, but not their dates.Automatic grouping:
This reverts commit \\b([0-9a-fA-F]{40})\\b
and the hash was found in this week's commits.
Automatic categories:
Source code:
Generated with commits-periodical 0.20 at 2026-07-13 17:53:16+00:00.
This work is supported by Tarsnap Backup Inc.
Alternate version: 2026-06-29 (debug) (contains info about the classification)