[Midnightbsd-cvs] [MidnightBSD/src] e495a1: kqueue: Fix a race when adding an fd-based knote t...

Lucas Holt noreply at github.com
Thu May 21 11:07:17 EDT 2026 

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: e495a12a6330474da273c00bdbd54a82ad185b20
      https://github.com/MidnightBSD/src/commit/e495a12a6330474da273c00bdbd54a82ad185b20
  Author: Mark Johnston <markj at FreeBSD.org>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M sys/kern/kern_event.c
    M sys/sys/filedesc.h

  Log Message:
  -----------
  kqueue: Fix a race when adding an fd-based knote to a queue

When registering a new kevent backed by a file descriptor, we first look
up the file description with fget(), then lock the kqueue, then see if a
corresponding knote is already registered.  If not, and KN_ADD is
specified, we add the knote to the kqueue.

closefp_impl() interlocks with this process by calling knote_fdclose(),
which locks each kqueue and checks to see if the fd is registered with a
knote.  But, if userspace closes an fd while a different thread is
registering it, i.e., after fget() succeeds but before the kqueue is
locked, then we may end up with a mismatch in the knote table, where the
knote kn_fp field points to a different file description than the knote
ident.

Fix the problem by double-checking before registering a knote.  Add a
new fget_noref_unlocked() helper for this purpose.  It is a clone of
fget_noref().  We could simply use fget_noref(), but I like having an
explicit unlocked variant.

PR:		293382
Reviewed by:	kib
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D55852

(cherry picked from commit 8f3227f527567aef53da845ab78da8e16d9051c1)


  Commit: 4dc8e934004692818d742e7719ab4b3e00efd95c
      https://github.com/MidnightBSD/src/commit/4dc8e934004692818d742e7719ab4b3e00efd95c
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.sbin/midnightbsd-update/midnightbsd-update.sh

  Log Message:
  -----------
  no need to do this.  certctl rehash is run


  Commit: 0ae4b63f168b86424216bc8799dbf65d13191cd8
      https://github.com/MidnightBSD/src/commit/0ae4b63f168b86424216bc8799dbf65d13191cd8
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M bin/cat/cat.1
    M bin/cat/cat.c
    A bin/cat/tests/A_flag_test.sh
    M bin/cat/tests/Makefile

  Log Message:
  -----------
  cat: add -A flag (equivalent to GNU cat -A) (#357)

Add -A flag to cat(1) utility, which is equivalent to -et (enables
vflag, eflag, and tflag). This matches the behavior of GNU cat.

Updated man page and added a new ATF test case to verify equivalence.

AI-Assisted-by: Gemini CLI <noreply at google.com>


  Commit: 6632a667c74aa2ea56e4514a54a5e69e26bccaf4
      https://github.com/MidnightBSD/src/commit/6632a667c74aa2ea56e4514a54a5e69e26bccaf4
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/spell/spellprog/Makefile
    M usr.bin/spell/spellprog/spellprog.c
    A usr.bin/spell/spellprog/tests/Makefile
    A usr.bin/spell/spellprog/tests/spellprog_test.sh

  Log Message:
  -----------
  spellprog: fix OOB reads and EOF slurp hang

Avoid reading before the word buffer when checking suffixes, prevent prefix-space overflow, and handle EOF while discarding overlong words. Add basic ATF regression tests.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 239c7c6ed21caedee56b17b602374c13b5181174
      https://github.com/MidnightBSD/src/commit/239c7c6ed21caedee56b17b602374c13b5181174
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/progress/Makefile
    M usr.bin/progress/progress.c
    A usr.bin/progress/tests/Makefile
    A usr.bin/progress/tests/progress_test.sh

  Log Message:
  -----------
  progress: fix gzip -l injection and EINTR wait loop

Avoid popen()/shell when running gzip -l by forking gzip with argv, and handle EINTR correctly in the wait loop.

Add an ATF regression test for -z with metacharacters in filenames.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 25b72d8c6f2c1ccb236bb351ac9139bd19285c58
      https://github.com/MidnightBSD/src/commit/25b72d8c6f2c1ccb236bb351ac9139bd19285c58
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/wall/wall.c

  Log Message:
  -----------
  wall: harden message buffer sizing

Use size_t for message length and validate fstat() size before allocating/reading to avoid integer truncation and potential overflow.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: f5a28f693f96d80cd4ab27f06de0352ac02d2083
      https://github.com/MidnightBSD/src/commit/f5a28f693f96d80cd4ab27f06de0352ac02d2083
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/w/Makefile
    A usr.bin/w/tests/Makefile
    A usr.bin/w/tests/w_test.sh
    M usr.bin/w/w.c

  Log Message:
  -----------
  w: harden tty path handling and width math

Reject suspicious utmpx ut_line values to avoid path traversal in /dev lookups and prevent argwidth underflow on narrow terminals. Add basic ATF smoke tests for w/uptime.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: efb9b577f940bf76b2cf65f1f7a498162a43e6af
      https://github.com/MidnightBSD/src/commit/efb9b577f940bf76b2cf65f1f7a498162a43e6af
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/ident/ident.c

  Log Message:
  -----------
  ident: avoid underflow when validating keyword termination

Use the open_memstream size (sz) when checking the character before the closing '$' to avoid strlen()-based underflow on malformed inputs.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: a1f7132f7e1f05a0490f5b0aa8dee0c54da6d2a7
      https://github.com/MidnightBSD/src/commit/a1f7132f7e1f05a0490f5b0aa8dee0c54da6d2a7
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    M usr.bin/asa/asa.c

  Log Message:
  -----------
  asa: guard against zero-length fgetln()

Skip zero-length lines to avoid len-1 underflow when checking for a trailing newline.

AI-Assisted-by: GPT-5.2 (Codex CLI)
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 6225f98b6fafa5ad26e9956594ad7203446bd10a
      https://github.com/MidnightBSD/src/commit/6225f98b6fafa5ad26e9956594ad7203446bd10a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-05-21 (Thu, 21 May 2026)

  Changed paths:
    A GEMINI.md

  Log Message:
  -----------
  add a gemini placeholder


Compare: https://github.com/MidnightBSD/src/compare/114cc9f385a7...6225f98b6faf

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications

More information about the Midnightbsd-cvs mailing list