Thread index · Date index · Mailing lists
Branch: refs/heads/stable/4.0\n Home: https://github.com/MidnightBSD/src\n Commit: bf92684469905164cc9752965946f5c90729e2a2\n https://github.com/MidnightBSD/src/commit/bf92684469905164cc9752965946f5c90729e2a2\n Author: Mark Johnston <markj@FreeBSD.org>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M usr.sbin/bhyve/pci_xhci.c\n\n Log Message:\n -----------\n bhyve: Fix handling of the xhci event ring\n\nrts->erst_p and rts->erstba_p are pointers to guest-controlled memory\nwhich describe the event rings and pending event array, respectively.\nThe device model was not validating the size nor saving the value.\nAs a result, the bounds checks in pci_xhci_insert_event() were\nsusceptible to TOCTOU races.\n\nFix pci_xhci_rtsregs_write() to save the ring size in a softc field.\nValidate that the size isn't larger than the maximum allowed by the XHCI\nspecification (64KB, or 4096 TRBs).\n\nWhen processing TRBs, make sure we don't load fields more than once.\nMake sure that pci_xhci_trb_next() doesn't return a pointer to host\nmemory. When handling ERDP writes, make sure that the guest-supplied\naddress is actually a pointer into the TRB array, and ignore the write\nif not.\n\nApproved by:\tso\nSecurity:\tFreeBSD-SA-26:72.bhyve\nSecurity:\tCVE-2026-101309\nReported by:\tBrian Delgado from Intel using Anthropic Opus 4.8\nDifferential Revision:\thttps://reviews.freebsd.org/D60677\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n Commit: ae13e7b7507a15ad6f0647ee8d1f5e60a62cde88\n https://github.com/MidnightBSD/src/commit/ae13e7b7507a15ad6f0647ee8d1f5e60a62cde88\n Author: Mark Johnston <markj@FreeBSD.org>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M usr.sbin/bhyve/pci_hda.c\n\n Log Message:\n -----------\n bhyve: Improve HDA stream descriptor validation\n\nThe length of each block in the stream must be non-zero. This is\nassumed in hda_transfer(), otherwise an out-of-bounds read or write is\npossible.\n\nUse atomic loads to access stream descriptor fields, since they are\nguest-controlled. Make sure that the descriptor array is suitably\naligned so that we can drop the __packed annotation from the structure\ndefinition; per section 3.3.42 of the HDA spec the BDL pointer is\nsupposed to be 128-byte aligned, in fact.\n\nApproved by:\tso\nSecurity:\tFreeBSD-SA-26:72.bhyve\nSecurity:\tCVE-2026-101310\nReported by:\tBrian Delgado from Intel using Anthropic Opus 4.8\nSponsored by:\tThe FreeBSD Foundation\nDifferential Revision:\thttps://reviews.freebsd.org/D60678\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n Commit: 0de6ff440794ebb85fc2d51033e853ce7581525e\n https://github.com/MidnightBSD/src/commit/0de6ff440794ebb85fc2d51033e853ce7581525e\n Author: Mark Johnston <markj@FreeBSD.org>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M usr.sbin/bhyve/bhyvegc.h\n M usr.sbin/bhyve/pci_fbuf.c\n M usr.sbin/bhyve/rfb.c\n\n Log Message:\n -----------\n bhyve: Fix handling of framebuffer resizing\n\nThe rfb code maintains an array of CRCs for 32x32 tiles in the\nframebuffer. This array is sized statically based on the rfb code's\nnotion of the maximum framebuffer size, which changed in commit\nfb51ddb20d57 without updating the rfb code.\n\nMorever, writes to the framebuffer BAR can modify the recorded height\nand width of the framebuffer. These values were not validated against\nthe maximum at all, unlike the parameters set via bhyve config.\n\nFix these problems:\n- Define the maximum width and height in a shared header file so that\n they do not get out of sync again.\n- In pci_fbuf_render(), don't resize the console if the new dimensions\n are too large.\n- Add a mutex to synchronize framebuffer BAR I/O with the rfb thread.\n\nApproved by:\tso\nSecurity:\tFreeBSD-SA-26:72.bhyve\nSecurity:\tCVE-2026-101311\nFixes:\t\tfb51ddb20d57 (\"bhyve: increase fbuf display resolution limit\")\nSponsored by:\tThe FreeBSD Foundation\nDifferential Revision:\thttps://reviews.freebsd.org/D60680\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n Commit: 210e9623e6c480a3ecc25f71730871e8d7de5969\n https://github.com/MidnightBSD/src/commit/210e9623e6c480a3ecc25f71730871e8d7de5969\n Author: Lucas Holt <luke@foolishgames.com>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M UPDATING\n\n Log Message:\n -----------\n UPDATING: bhyve SA-26:72\n\nRecord the bhyve(8) fixes from FreeBSD-SA-26:72.bhyve.\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\nCompare: https://github.com/MidnightBSD/src/compare/78c6300d6968...210e9623e6c4\n\nTo unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications\n\nMidnightbsd-cvs\nmidnightbsd-cvs@midnightbsd.org\nTo unsubscribe: midnightbsd-cvs+unsubscribe@midnightbsd.org\nhttps://lists.midnightbsd.org/\n