Currently our man(1) utility search manages only in $lang_country.$charset, $lang.$charset and,
as failover, in en.$charset which is historical behavior.
But nowadays most of ported software uses only $lang subdirectories for translated manpages
instead of use full locale notation, for example, share/ja/man1, share/de/man1, share/ru/man1.
In such cases, our man(1) utility cannot find any translated manpages and silently fallback to english version.
Add $man_lang in search path allows man(1) search and use translated manpages under historical and modern path traditions
MFC after: 1 day
MFC to: stable/15 stable/14
Reviewed by: ziaee, fernape
Approved by: fernape
Differential Revision: https://reviews.freebsd.org/D55805
(cherry picked from commit 5250c98908)
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
correction to both 32-bit and 64-bit switch paths.
The 2015 change moved the release after the stack switch because the old
implementation continued through pmap_activate() and optional state
restoration on the outgoing thread's stack after making that thread
runnable. The switch path has since changed: after the release it only
polls wired td_lock state using registers, then immediately loads the
incoming PCB_SP before updating per-CPU state or making any calls.
cpu_switch() also runs with external and decrementer interrupts disabled
by spinlock_enter(). Thus this does not restore the post-release call
window that the 2015 change corrected.
Reviewed by: jhb, jhibbits
Approved by: jhb (mentor)
Fixes: 53607fe3cc ("Fix an extremely subtle concurrency bug...")
Fixes: 7a49d964d3 ("Merge r278429 from ppc64:")
Fixes: 8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59742
(cherry picked from commit 0571d8a0cc)
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355)
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118)
vmm doesn't implement them, and after commit 2272fac218
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72)
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <[email protected]>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a68145)
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: pouria, tuexen, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60143
(cherry picked from commit 80af0a32e4)
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c)
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <[email protected]>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28cc)
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394ab)
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d)
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by: zlei, ae, glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59919
(cherry picked from commit 10729d0ce1)
aout_coredump() was removed in commit 1eecfae3e5.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4523cbbfef)
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8)
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d150619)
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59726
(cherry picked from commit cb035c19c3)
atomic_load_* is a read, not a write. Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0aa055edc1)
vfs_register hashes the filesystem name and uses it for sysctl oids.
A filesystem name which hashes to 0 crashes in sysctl_register_oid().
Map 0 to 1 to prevent the kernel crash.
This can be tested with "udf2" as the filesystem name.
MFC after: 1 month
MFC to: stable/15 stable/14
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59839
(cherry picked from commit 3897678132)
grab_mcontext() only put the second halves of vs0-31 into the context
while the thread owned the VSX unit, but sigreturn(2) gives ownership
up so that the next use reloads the registers lazily. A signal that
arrives right after a sigreturn, like one the handler's mask was
holding back, got a context without them and its own sigreturn then
zeroed them in the PCB.
The halves saved in the PCB are current whenever the FP state is, since
VSX instructions can't run without PCB_VSX and save_fpu() stores them
in that case, so export them together with the FP registers.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60754
(cherry picked from commit 64b2fea9a2)
(cherry picked from commit 0e9af9fb72)
We don't have anything to tunnel without INET or INET6, so just smack
it with the same config(5) hammer that ovpn uses and exclude it from
such builds.
Reported by: mjg
Reviewed by: emaste, markj
(cherry picked from commit 8430de47aa)
c4640126f1 ("loader.efi: Apply command-line DHCP overrides earlier")
was really good, but moving it just one statement earlier is even
better. polarian on Libera describes a GELI setup on a system that
doesn't advertise a serial console via ConOut. They don't have serial
input at the point that they would get prompted for the GELI passphrase,
but if we parse args just before devinit() then he can override the
console with `efibootmgr -e`. This gives UEFI one advantage over BIOS
loader, as /boot.config isn't available to provide that kind of override
if your impediment is GELI.
We also considered reading loader.env earlier, but we have a chicken/egg
problem in that we must have probed for the ESP to be able to open() it.
We would instead need a devinit_early() and devinit_late() scheme that
allows GELI probing to be deferred until the later pass, after reading
loader.env to pick up the console override. That's an idea I'd still
like to discuss because it's more robust than hoping that firmware won't
wipe out our efibootmgr(8) entries.
Tested by: polarian on Libera
Reviewed by: imp
(cherry picked from commit 78887369c4)
The bounds check rejected any access ending exactly at the end of the
register block, so a four byte write at offset 0xffc was refused,
returning EINVAL and killing the VM.
PR: 291063
Fixes: 75909086a4 ("bhyve: allow read/write to full CRB buffer")
Sponsored by: Defenso
Signed-off-by: Quentin Thébault <[email protected]>
Reviewed-by: aokblast, kevans, markj
(cherry picked from commit 4505445ccd)
If an explicit loader wasn't requested, then bhyveload(8) maintains a
/boot handle that it can use for swapping to a different flavor. This
means that we expose all of the host /boot to the sandbox for the
duration of script execution.
Add a callback to ack that we're OK with the interpreter so that
bhyveload(8) can release the bootfd. This is worth doing because it's
prior to guest script execution, so we're still running a reasonably
untainted process.
Reviewed by: imp, jhb
(cherry picked from commit 619d092177)
As noted in the comment, some headsets with a hardware sidetone are
incredibly sensitive and emit immediate feedback upon attach with the
current system-wide default of 75%. Drop it down just for snd_uaudio(4)
to avoid incredibly unpleasant surprises.
Reviewed by: christos
(cherry picked from commit c3c6a6c782)
The Logitech H390, for instance, has the following interface layout:
~~
7 INPUT 34 INPUT 10 INPUT
Mic (0x201) Mic (0x201) USB Stream (0x101)
| | |
v v |
19 FEATURE 35 FEATURE |
| | |
v v |
25 EXTENSION +------> 36 MIXER <---+
| |
v v
13 OUTPUT 22 FEATURE
USB Stream (0x101) |
v
16 OUTPUT
Speaker (0x301)
~~
The 7->13 path on the left is a typical microphone-in configuration,
while the right side is a little more complicated. The 34 -> 35 -> 36
leg is describing a hardware sidetone control, while the other is a
standard audio-out configuration.
During feature unit evaluation, we need to pick up the scenario of node
35 above, which is directly wiring the microphone to the speaker. Right
now we'll likely tie it to the pcm/vol levels and this unit will emit
a very prompt feedback screech, but it's really shaped more like a
MONITOR control.
This avoids mishandling feature unit 22 because that's evaluated in one
of the other cases: one of the inputs is the USB stream, so it's
wired up as a PCM.
One note on this headset: the presence of mixer 36 currently breaks the
`vol` control, leaving only `pcm` to control the volume. Given that it
has both Mic and USB input, I suspect we get a 1:1 cluster configuration
for the Mic input but something more complicated for the USB input that
we end up ignoring. Thus, "vol" might technically control the monitor
volume but isn't wired up to the USB input cluster. I have not had a
chance to confirm this, yet.
PR: 291424
Reviewed by: christos
(cherry picked from commit f01b594b7f)
Kernel mode program, trace, breakpoint and machine check exceptions go
through dbtrap, which saves the registers on trapstk and, if KDB doesn't
want the trap, restores them from there and continues with the normal
trap handler. There was just one trapstk for all CPUs, so when two of
them trapped at the same time they overwrote each other's frame and one
of them carried on with the other's registers. DTrace fbt probes are
these traps, so a probe on a function that runs on several CPUs at once
took the kernel down within seconds.
Keep the stack in the pcpu instead. The boot CPU gets a static one,
since it's set up before malloc works, the others allocate theirs in
cpu_pcpu_init() like the Book-E critical interrupt stack.
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60362
(cherry picked from commit eaaf838e33)
(cherry picked from commit 268e7c2ff7)
Without it, LLVM libunwind doesn't know where to stop when unwinding the
main thread, so it uses a stale LR as the return address and crashes.
Our libunwind doesn't do that since 5866c369e4 reverted it, but
programs that bundle their own copy, like ClickHouse, are hit by it.
amd64, arm64, i386 and riscv already have the same annotation.
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60740
(cherry picked from commit c4fde87a32)
(cherry picked from commit aaa1abfc0b)
This is the program that found the races fixed in 1f1043d550. One
thread keeps a pattern in f14-f31 across a signal, while helpers pinned
to the same CPU keep different patterns in the real registers and get
woken up from another CPU to preempt it at random points. If the kernel
ever hands it somebody else's registers, the pattern doesn't match.
The register loads, the thr_kill() and the handshake with the helper are
in assembly so that nothing touches the FP registers between sigreturn
and the check. It runs for ten seconds and is skipped with fewer than
two CPUs.
Requested by: adrian
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60411
(cherry picked from commit 35a226dded)
(cherry picked from commit 8d36589470)
The LAN8700 / LAN8710 PHYs were Standard Microsystems Corporation parts,
which early on used SMC as an abbreviation but they were using SMSC when
they were exclusively an IC maker (as opposed to full add-in NICs).
SMSC was acquired by Microchip in 2012. I kept the pre-acquisition
name, as NetBSD (from where we obtained miidevs) uses SMSC.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56819
(cherry picked from commit 89c883c09a)
(cherry picked from commit f2f67df8c9)
The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>. Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.
Suggested by: jhb
Reviewed by: jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59659
(cherry picked from commit 9d50245a0f)
(cherry picked from commit 252500da3a)
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
(cherry picked from commit 82af7f44eb)
Currently, userdisk_init() iterates through disks and
checks whether DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls
are available for the device. If either ioctl fails, userdisk_init()
returns ENXIO with ud_info only partially initialized.
devinit() records the failure, but loader_main() ignores
devinit()'s return value, so later code may access an
uninitialized entry.
In certain cases this code can still boot from a disk even if
userdisk_init() returns ENXIO, for example, when the first of
two disks is valid and the second errors out.
To address this issue while not breaking the current behavior, do
the following:
- Zero-initialize the userdisk_info array and use a zero media size
to mark disks that do not support the ioctls mentioned above or
report an empty medium.
- Update userdisk_print() not to print unusable disks.
- Update userdisk_open() to return EIO for unusable disks.
- Update extract_currdev() to pick the first usable disk
instead of the first disk. Introduce userboot_disk_firstunit()
for that.
Additionally, reset counters on ud_info allocation failure to prevent
accessing unallocated data.
Reviewed by: jhb (previous version), markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59262
(cherry picked from commit 4445d03958)
The device has multiple PIDs as it supports different USB profiles.
Approved by: adrian
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60482
(cherry picked from commit 95432767dd)
Ubuntu 24.04 is the most recent LTS release. Use it and the previous
22.04 LTS for cross build testing.
Reported by: emaste, jhb
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/1399
(cherry picked from commit 386e2dc442)
[compiler-rt] Add interceptors for free_[aligned_]sized for asan+hwasan (#189109)
This avoids a jemalloc assertion when running sanitized applications
against glib, which uses free_sized(3).
PR: 298943
MFC after: 1 week
(cherry picked from commit a3fbf20c05)
asan: refactor interceptor allocation/deallocation functions (#145087)
Do some refactoring to allocation/deallocation interceptors. Expose
explicit per-alloc_type functions and stop accepting explicit AllocType.
This ensures we do not accidentally mix.
NOTE: This change rejects attempts to call `operator new(<some_size>,
static_cast<std::align_val_t>(0))`.
For https://github.com/llvm/llvm-project/issues/144435
Signed-off-by: Justin King <[email protected]>
This a prerequisite for adding sanitizer interceptors for free_sized(3)
and free_aligned_sized(3).
PR: 298943
MFC after: 1 week
(cherry picked from commit 6b0f64133c)
After base ef758b59a4 we can enable usage
of .preinit_array in compiler-rt's sanitizers. The comment that stated
"On FreeBSD, .preinit_array functions are called with rtld_bind_lock
writer lock held. It will lead to dead lock ..." can also be removed.
PR: 298943
MFC after: 1 week
(cherry picked from commit 0008561567)
The virtio-gpu resource formats are defined by byte order in memory,
while vt(4) and the X server (through vt_fb and the fb mmap) write
native 32-bit 0x00RRGGBB pixels into the shadow framebuffer. On a
big-endian guest such as powerpc64 those pixels land in memory as
00 RR GG BB, which the host interprets under B8G8R8X8 with red and
blue swapped and the padding byte taken as blue: white renders yellow
and blue renders black.
Request X8R8G8B8 on big-endian guests instead, which is also what the
Linux driver does (DRM_FORMAT_HOST_XRGB8888). Reproduced with a colour
test pattern on a powerpc64 QEMU pseries guest using the identically
coded out-of-tree fork of this driver (graphics/virtio-gpu-qemu-kmod);
little-endian guests are unchanged.
Differential Revision: https://reviews.freebsd.org/D60085
Approved by: jhibbits
MFC after: 1 week
(cherry picked from commit 7cf02164a5)
(cherry picked from commit ceaf30c92e)
Dima Panov