FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F14.3 2026-04-28T20:33:04Z 2026-04-28T20:33:04Z Mariusz Zaborski oshogbo@FreeBSD.org 2026-04-28T14:36:09Z urn:sha1:aa15809f85deef33167bf74f82144d714a884548 nvlist_check_header() validated nvlh_size for overflow before performing conversion. An mallicous user can set NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that the orginall value passes the check, but after the conversion the sizeof(nvlist_header) + size can overflow. This can lead to a heap buffer overflow. Approved by: so Security: FreeBSD-SA-26:17.libnv Security: CVE-2026-35547 Fixes: 36fa90dbde0060aacb5677d0b113ee168e839071 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56342 2026-04-28T20:33:04Z Mariusz Zaborski oshogbo@FreeBSD.org 2024-08-29T13:46:01Z urn:sha1:0963be1dbf8886423c0c4efade79661989db9a77 Approved by: so Differential Revision: https://reviews.freebsd.org/D46131 (cherry picked from commit 241a7ddd7112982ed41ccdd047c1dad59ee0256e) 2025-07-02T05:51:38Z Gordon Tetlow gordon@FreeBSD.org 2025-07-02T05:51:38Z urn:sha1:cb24a62cd75b582c53f5bd600650bddd09a0ee89 From the upstream pull request merges: #17340 b144b160b Fix 2 bugs in non-raw send with encryption Obtained from: OpenZFS Approved by: so Security: FreeBSD-EN-25:10.zfs 2025-05-13T12:41:33Z Olivier Certner olce@FreeBSD.org 2025-05-01T16:02:44Z urn:sha1:de6a4418eec91dc8802defce0159c126a2c7b6d2 Introduce two helpers, the more general SYSCTL_SIZEOF() and a struct-specific one SYSCTL_SIZEOF_STRUCT() which prepends 'struct' in the description and in the use of sizeof() but uses the raw structure name as the knob's name. The size of the object/structure is exported under 'debug.sizeof'. Existing knobs under 'debug.sizeof' were all converted to use the helpers. Add a note before the helpers discouraging the introduction of new leaves for ad-hoc reasons. List alternative means for developers to obtain the size of arbitrary kernel structures easily (thanks to markj@ for providing these). No functional change (intended). Reviewed by: kib, markj MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D50121 (cherry picked from commit 713abc9880aabe0ff924ff644bceb6ff404ed3cd) (cherry picked from commit efce9f8a510b60736994e50288b78fc7b32b5d90) Approved by: re (cperciva) 2025-04-29T22:29:51Z Bjoern A. Zeeb bz@FreeBSD.org 2025-04-24T08:48:26Z urn:sha1:8ef44245179141965f25203b3e390a9423a2169f This version is based on git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 38fec10eb60d687e30c8c6b5420d86e8149f7557 ( tag: v6.14 ). Sponsored by: The FreeBSD Foundation (cherry picked from commit a0ccc12f6882a886d89ae279c541b2c2b62c6aca) 2025-04-29T22:29:51Z Bjoern A. Zeeb bz@FreeBSD.org 2025-04-24T08:58:54Z urn:sha1:b6e8b845aeab65e208ac277f02d5d4007ae76403 This version is based on git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 38fec10eb60d687e30c8c6b5420d86e8149f7557 ( tag: v6.14 ). Sponsored by: The FreeBSD Foundation (cherry picked from commit df279a26d3315e7abc9e6f0744137959a4c2fb86) 2025-04-29T10:49:32Z Bjoern A. Zeeb bz@FreeBSD.org 2025-04-24T10:27:49Z urn:sha1:92a74b3bcee9344588a41c7a3f664eb4020e8299 Move some structs into the appropriate header to be visible. Add new fields to structs and enums. Remove arguments from two functions (one function currently unused by drivers in the tree, for the other the argument was unused). Adjust the iwlwifi accordingly. This is in preparation for new driver versions to allow a smooth transition. Sponsored by: The FreeBSD Foundation (cherry picked from commit e6010da63903cc6d9aac0077ab861cfd6bae2aa7) 2025-04-29T10:49:27Z Bjoern A. Zeeb bz@FreeBSD.org 2025-03-15T00:14:52Z urn:sha1:1be235fcc48c95e686dd1f69e8daba953dac1ecc So far we have not compiled wow.c given we do not enable CONFIG_PM yet. Make the necessary file local adjustments to make the file compile once further changes in LinuxKPI 802.11 code are comitted. Sponsored by: The FreeBSD Foundation (cherry picked from commit 848fdcae0326db5b7c3edd2e8c264d25254abe1d) 2025-04-29T10:49:27Z Bjoern A. Zeeb bz@FreeBSD.org 2025-03-15T00:08:14Z urn:sha1:e569281114500b58e04d64891a884286295d4cae Given we currently do not ompile the file by default make it compile again after the last vendor import. Sponsored by: The FreeBSD Foundation (cherry picked from commit 52a43041d2a864961f0a1a109a7a7c4c6ebed918) 2025-04-18T14:36:03Z Bjoern A. Zeeb bz@FreeBSD.org 2025-04-08T16:57:14Z urn:sha1:42be6050cec78ed6abf2e4845f4b9e525d5c2403 Following the example of rtw88 and rtw89 only ship iwlwifi firmware from ports/packages. Users are asked to run fwget(8) to install the firmware needed for their system or build it from ports (see also UPDATING). This is the end of a long story adding wireless support to fwget(8), migrating the firmware for multiple branches into ports, splitting them up into flavors, and updating some install media and the installer to provide firmware. The overall amount for new firmware amongst all drivers would have added more than 100M of binary blobs to src.git for the first import, ignoring future updates which (along with some duplication between multiple drivers) was considered too much. While maintenance within the src tree certainly would have been easier in the longer term this seems to be the better solution and I would like to thank everyone who helped along the path to get there. The iwlwififw.4 man page is to stay (for now) and will likely point at the appropriate firmware package flavor in the future as well so people may find it easier to transition. In the long term this information is likely not needed anymore. Sponsored by: The FreeBSD Foundation Requested by: core (Oct 2022) Reviewed by: thj, jrm (earlier) Differential Revision: https://reviews.freebsd.org/D49713 (cherry picked from commit 558d638896239f9cd25b9d825ecfce62ec54681e) (cherry picked from commit 918783b75aacb051f2f83dd0198ef68bc9fa5326)