FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=stable%2F13 2026-04-07T15:52:56Z 2026-04-07T15:52:56Z Dag-Erling Smørgrav des@FreeBSD.org 2026-04-01T17:14:16Z urn:sha1:b3bf8410a56260bc0f26b5197b3c8764f3283e9d * cd9660_rrip_slink() did not check that the lengths of individual entries do not exceed the length of the overall record. * cd9660_rrip_altname() did not check that the length of the record was at least 5 before subtracting 5 from it. Note that in both cases, a better solution would be to check the length of the data before calling the handler, or immediately upon entry of the handler, but this would require significant refactoring. MFC after: 1 week Reported by: Calif.io in collaboration with Claude and Anthropic Research Reported by: Adam Crosser, Praetorian Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56215 (cherry picked from commit d0afead876076f605c363f03d92304d1bd75be1c) 2026-02-09T16:54:57Z Mark Johnston markj@FreeBSD.org 2026-02-09T16:47:16Z urn:sha1:f7cbcb19a9ecf606172d6d6c472b5ba7130a398b The O_RESOLVE_BENEATH openat(2) flag restricts name lookups such that they remain under the directory referenced by the dirfd. This commit introduces an implicit version of the flag, FD_RESOLVE_BENEATH, stored in the file descriptor entry. When the flag is set, any lookup relative to that fd automatically has O_RESOLVE_BENEATH semantics. Furthermore, the flag is sticky, meaning that it cannot be cleared, and it is copied by dup() and openat(). File descriptors with FD_RESOLVE_BENEATH set may not be passed to fchdir(2) or fchroot(2). Various fd lookup routines are modified to return fd flags to the caller. This flag will be used to address a case where jails with different root directories and the ability to pass SCM_RIGHTS messages across the jail boundary can transfer directory fds in such as way as to allow a filesystem escape. PR: 262180 Reviewed by: kib MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D50371 (cherry picked from commit f35525ff2053e026a423e852136d73ed93c95803) 2025-11-19T20:47:50Z Mark Johnston markj@FreeBSD.org 2025-05-27T13:29:14Z urn:sha1:503ab844ceced16c7e8736c0caa586ff0bab5f0e This truncation is mostly harmless today, but fix it anyway to avoid pain later down the road. Reviewed by: olce, kib MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D50417 (cherry picked from commit 0d224af399a66f00a5b33e5512fc018062cabf1d) 2025-11-19T20:47:50Z Mark Johnston markj@FreeBSD.org 2025-05-23T12:52:24Z urn:sha1:592de68e328b4edf8acdb2a0b0b66a813747b440 Suppose a process has its cwd pointing to a nullfs directory, where the lower directory is also visible in the jail's filesystem namespace. Suppose that the lower directory vnode is moved out from under the nullfs mount. The nullfs vnode still shadows the lower vnode, and dotdot lookups relative to that directory will instantiate new nullfs vnodes outside of the nullfs mountpoint, effectively shadowing the lower filesystem. This phenomenon can be abused to escape a chroot, since the nullfs vnodes instantiated by these dotdot lookups defeat the root vnode check in vfs_lookup(), which uses vnode pointer equality to test for the process root. Fix this by extending nullfs and unionfs to perform the same check, exploiting the fact that the passed componentname is embedded in a nameidata structure to avoid changing the VOP_LOOKUP interface. That is, add a flag to indicate that containerof can be used to get the full nameidata structure, and perform the root vnode check on the lower vnode when performing a dotdot lookup. PR: 262180 Reviewed by: olce, kib MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D50418 (cherry picked from commit 7587f6d4840f8d363e457cddc14c184cf1fe7cc1) 2025-11-19T20:47:50Z Konstantin Belousov kib@FreeBSD.org 2025-05-17T05:37:48Z urn:sha1:19b91b15530d1ed0453ce073fb15d1f790ff85e4 Reviewed by: olce Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D50390 (cherry picked from commit 89549c2348170921cc4270ac95bfabfd78d42739) 2025-11-14T14:43:53Z Dag-Erling Smørgrav des@FreeBSD.org 2025-11-10T13:58:11Z urn:sha1:3e8d5f36082414373462743d775db005daf07339 Since the introduction of permission masks, cd9660_getattr() returns a size of zero for all symbolic links, because the code to retrieve the length of the link target (as required by POSIX) is dead, since we strip away the type bits before we try to use them to identify the file as a link. Address this by checking the vnode type instead. PR: 290556 MFC after: 3 days Fixes: 82f2275b73e5 ("cd9660: Add support for mask,dirmask,uid,gid options") Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D53598 (cherry picked from commit 978aaa72f3196f5489630052762cac5a7863e774) 2025-08-28T09:14:33Z Gordon Bergling gbe@FreeBSD.org 2025-08-25T08:42:23Z urn:sha1:87e0274be95993dd3652d5eec9f6b45c7ecd41a4 - s/fist/first/ (cherry picked from commit ac4005219166fc94da4ebb7adce3da159072f6d3) 2025-07-24T13:02:12Z Dag-Erling Smørgrav des@FreeBSD.org 2025-07-16T19:33:24Z urn:sha1:4cafd1021a5b6002812f4446794541eab8c08534 The existing code frequently assigns unsigned 64-bit values to variables that are signed and / or shorter without checking for overflow. Try to deal with these cases. While here, fix two structs that used single-element arrays in place of flexible array members. PR: 287896 MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D51339 (cherry picked from commit 55f80afa17e8926f69660f19631194bcf7fa66f4) 2025-05-08T06:45:28Z Gordon Bergling gbe@FreeBSD.org 2025-05-05T08:47:23Z urn:sha1:faf7c4ad59df3a6870a9aa8d80767bd750991817 - s/demostrates/demonstrates/ (cherry picked from commit f6674f74fb299821d0f159b9f11cf7dd9b3e70ad) 2025-02-27T02:35:54Z Rick Macklem rmacklem@FreeBSD.org 2025-02-24T20:58:27Z urn:sha1:319b59fbde2fb90bd4e41d1f66aa59e56f66f1fe It was reported on freebsd-fs@ that unrolling a tarball failed to set the correct modify time if delegations were being issued. This patch fixes the problem. This bug only affects NFSv4 mounts where delegations are being issued. Not running the nfscbd or disabling delegations on the NFSv4 server avoids the problem. (cherry picked from commit b616d997cb48eaafe13069eecd95f0495b2358eb)