machine/ieeefp.h: include <sys/cdefs.h>
The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>. Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.
Suggested by: jhb
Reviewed by: jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59659
(cherry picked from commit 9d50245a0f1333e10cc1c4dda16878cd79a7c42b)
(cherry picked from commit 252500da3a45a89d91c276db88f9669314cc2dfa)
machine/ieeefp.h: include <sys/cdefs.h>
The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>. Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.
Suggested by: jhb
Reviewed by: jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59659
(cherry picked from commit 9d50245a0f1333e10cc1c4dda16878cd79a7c42b)
LinuxKPI: restore several hard coded return values for the CONFIG_PM case
drm-kmod sets CONFIG_PM (unclear if for other parts) but LinuxKPI
has no understanding of a dev->power implementation for pm_runtime.h.
The return values based on !CONFIG_PM thus cause problems to drm-kmod.
Return the previous values under CONFIG_PM but leave the TODO logging
as the actual implementation is missing and return values may not be
universally correct (beyond the known drm-kmod use cases).
The following functions having a return value but none sepcific for
CONFIG_PM as (based on drm-kmod master):
pm_runtime_resume only caller ignores the return value
pm_runtime_set_active two callers ignore the return value
pm_runtime_put_autosuspend all callers seem to ignore the return value
pm_runtime_autosuspend 2/3 callers ignore the return value;
3rd is #ifdef __linux__
pm_runtime_suspended 3/4 callers ... do check the return value
but the logic expects the false, which also
[7 lines not shown]
pam_exec: fix the stderr close test and avoid a double close
The cleanup tested cherr[0] when closing cherr[1]. The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again. Clear each fd after closing and test the right
one.
Reviewed by: des, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60924
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
[3 lines not shown]
inetd: use snprintf() in inetd_setproctitle()
inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60879
ObsoleteFiles.inc: Add moved certificates
These two moved from trusted to untrusted.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Fixes: 21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
(cherry picked from commit dd6a1fef0ed2bf760a294106ab93fbcdcfdcae3d)
caroot: Regenerate
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
(cherry picked from commit 82af7f44ebefbe46cd635f63db300a066de48ee1)
ObsoleteFiles.inc: Add moved certificates
These two moved from trusted to untrusted.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Fixes: 21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
(cherry picked from commit dd6a1fef0ed2bf760a294106ab93fbcdcfdcae3d)
sys: centralize SV_* flags definitions for several FreeBSD ABIs
The omitted ABI is compat32 on arm64, which lacks SV_ASLR.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
caroot: Regenerate
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
(cherry picked from commit 82af7f44ebefbe46cd635f63db300a066de48ee1)
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
ObsoleteFiles.inc: Add moved certificates
These two moved from trusted to untrusted.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Fixes: 21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
(cherry picked from commit dd6a1fef0ed2bf760a294106ab93fbcdcfdcae3d)
caroot: Regenerate
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
(cherry picked from commit 82af7f44ebefbe46cd635f63db300a066de48ee1)
caroot: Clean up
* Get certdata.txt directly from the NSS Mercurial repository, rather
than from the Mozilla Firefox repository which imports it from NSS at
irregular intervals.
* Instead of always fetching the latest certdata.txt, fetch a specific
version. For this commit, we set this to the version that was last
imported in May 2025.
* Add a refrence to the MPL to the generated files.
* Regenerate with latest OpenSSL. This is purely cosmetic; mostly, the
certificate names now contain less unnecessary whitespace and some
elements are quoted.
Approved by: so
Security: FreeBSD-SA-26:73.caroot
MFC after: 1 week
[5 lines not shown]
