OpenBSD/src xtmsHXsusr.bin/tmux cmd-split-window.c tmux.1

   Typos and doc fixes, from Ben Boeckel.
VersionDeltaFile
1.144+5-5usr.bin/tmux/cmd-split-window.c
1.1139+8-1usr.bin/tmux/tmux.1
1.404+4-4usr.bin/tmux/format.c
1.420+4-4usr.bin/tmux/window-copy.c
+21-144 files

OpenBSD/src LjKr2Zzsys/sys proc.h

   oops, no the bit is available
VersionDeltaFile
1.399+1-0sys/sys/proc.h
+1-01 files

OpenBSD/src XVPgMbgsys/sys proc.h

   0x08000000 is P_SUSPSIG, so also defining PS_avail0 to the same position
   is misleading
VersionDeltaFile
1.398+1-2sys/sys/proc.h
+1-21 files

OpenBSD/ports HlUMqTOwww/mozilla-firefox distinfo Makefile

   www/mozilla-firefox: MFC update to 152.0.6.

   see https://www.firefox.com/en-US/firefox/152.0.6/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/
VersionDeltaFile
1.397.2.11+2-2www/mozilla-firefox/distinfo
1.680.2.13+1-1www/mozilla-firefox/Makefile
+3-32 files

OpenBSD/ports sybZfeowww/firefox-i18n distinfo Makefile.inc, www/mozilla-firefox distinfo Makefile

   www/mozilla-firefox: update to 152.0.6.

   see https://www.firefox.com/en-US/firefox/152.0.6/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/
VersionDeltaFile
1.398+164-164www/firefox-i18n/distinfo
1.412+4-4www/mozilla-firefox/distinfo
1.698+2-2www/mozilla-firefox/Makefile
1.353+1-1www/firefox-i18n/Makefile.inc
+171-1714 files

OpenBSD/src yETK8tdsys/crypto cryptosoft.c, sys/netinet ipsec_input.c ip_ah.c

   Handle allocation failure and track correct mbuf length in IPComp.
   In swcr_compdec() m_copyback(M_NOWAIT) may fail, but the error is
   not checked.  The mbuf chain could be too short, but the expected
   length is returned as result.  Then ipcomp_input() will not set
   m->m_pkthdr.len to the actual length of the mbuf chain.  This only
   affects decompression, other cases do not need additional memory
   for enlarging.
   from bluhm@; OK deraadt@

   IPComp decompression must not overflow mbuf cluster.
   Check after decompressing an IPComp packet, that the content fits
   into a mbuf cluster.  m_copyback() assumes that it can allocate a
   single mbuf cluster to enlarge the mbuf chain.  That means the
   decompressed data must not exceed MAXMCLBYTES.  Prevent panic:
   m_clget: request for 67948 byte cluster.
   from bluhm@; reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   IPsec AH must contain replay counter.
   Before reading the replay counter from packet header in ah_input(),

    [10 lines not shown]
VersionDeltaFile
1.91.18.1+18-5sys/crypto/cryptosoft.c
1.222.2.1+9-1sys/netinet/ipsec_input.c
1.179.2.1+5-1sys/netinet/ip_ah.c
+32-73 files

OpenBSD/src AKlsqpHsys/crypto cryptosoft.c, sys/netinet ipsec_input.c ip_ah.c

   Handle allocation failure and track correct mbuf length in IPComp.
   In swcr_compdec() m_copyback(M_NOWAIT) may fail, but the error is
   not checked.  The mbuf chain could be too short, but the expected
   length is returned as result.  Then ipcomp_input() will not set
   m->m_pkthdr.len to the actual length of the mbuf chain.  This only
   affects decompression, other cases do not need additional memory
   for enlarging.
   from bluhm@; OK deraadt@

   IPComp decompression must not overflow mbuf cluster.
   Check after decompressing an IPComp packet, that the content fits
   into a mbuf cluster.  m_copyback() assumes that it can allocate a
   single mbuf cluster to enlarge the mbuf chain.  That means the
   decompressed data must not exceed MAXMCLBYTES.  Prevent panic:
   m_clget: request for 67948 byte cluster.
   from bluhm@; reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   IPsec AH must contain replay counter.
   Before reading the replay counter from packet header in ah_input(),

    [10 lines not shown]
VersionDeltaFile
1.91.14.1+18-5sys/crypto/cryptosoft.c
1.221.2.1+9-1sys/netinet/ipsec_input.c
1.178.2.1+5-1sys/netinet/ip_ah.c
+32-73 files

OpenBSD/src Ao3YdNesys/dev/ic qwx.c

   run qwx_init() code under splnet()
VersionDeltaFile
1.137+13-4sys/dev/ic/qwx.c
+13-41 files

OpenBSD/src kRUU6jnregress/usr.sbin/bgpd/integrationtests as0.sh exabgp.as0.test2.in

   Run monitor exabgp session on new IP 10.12.57.5.

   10.12.57.2 is used in test1 and since exabgp retries immediatly the
   idleHoldTime of that peer goes up quickly and blocks further connects.
   Before this worked since bgpd sent the notification and the error count
   was not increased and with this immediate retries were possible.
VersionDeltaFile
1.3+3-1regress/usr.sbin/bgpd/integrationtests/as0.sh
1.3+2-2regress/usr.sbin/bgpd/integrationtests/exabgp.as0.test2.in
+5-32 files

OpenBSD/src Yu39M5zsys/dev/pci if_qwx_pci.c

   stop MHI channels and clear MHI event rings when the qwx interface goes down
VersionDeltaFile
1.39+103-32sys/dev/pci/if_qwx_pci.c
+103-321 files

OpenBSD/src 14TCGkosys/dev/pci if_qwx_pci.c

   reset qwx mhi transfer ring "queued" counter to zero when restarting the ring
VersionDeltaFile
1.38+2-1sys/dev/pci/if_qwx_pci.c
+2-11 files

OpenBSD/src jgMXgEJsys/dev/ic qwx.c

   do not zero the entire qwx sc->hal structure during resume

   The structure contains pointers to DMA allocations which are leaked and
   replaced by new allocations during resume if we zero the entire structure.
   At attach time, the structure comes pre-zeroed so an initial memset is
   not needed either.
VersionDeltaFile
1.136+1-4sys/dev/ic/qwx.c
+1-41 files

OpenBSD/src flY6XLzsys/nfs nfs_serv.c nfs_vnops.c

   cleanup when nfsm_srvmtofh1() errors in nfsrv_rename()
   corrects vnode references and namei_pool leak
   reported by Andrew Griffiths of Calif
   from jsg@; initial diff from deraadt@ ok miod@

   remove use of struct nfsm_info in nfs_serv.c (the non-trivial part)
   from jsg@; with and ok miod@

   remove use of struct nfsm_info in nfs_serv.c
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_mtouio() to nfsd_mtouio()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_strsiz() to nfsd_strsiz()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_dissect() to nfsd_dissect()
   from jsg@; with and ok miod@

    [106 lines not shown]
VersionDeltaFile
1.133.2.1+431-559sys/nfs/nfs_serv.c
1.209.6.1+100-78sys/nfs/nfs_vnops.c
1.49.10.1+85-4sys/nfs/nfsm_subs.h
1.2.10.1+21-30sys/nfs/nfs_srvsubs.c
1.156.8.1+12-19sys/nfs/nfs_socket.c
1.133.6.1+7-5sys/nfs/nfs_vfsops.c
+656-6952 files not shown
+665-7048 files

OpenBSD/src nCFCcdEsys/dev/ic qwx.c

   do not attempt to clean up qwx Tx rings which are uninitialized
VersionDeltaFile
1.135+3-2sys/dev/ic/qwx.c
+3-21 files

OpenBSD/src he5fHQxsys/nfs nfs_serv.c nfs_vnops.c

   cleanup when nfsm_srvmtofh1() errors in nfsrv_rename()
   corrects vnode references and namei_pool leak
   reported by Andrew Griffiths of Calif
   from jsg@; initial diff from deraadt@ ok miod@

   remove use of struct nfsm_info in nfs_serv.c (the non-trivial part)
   from jsg@; with and ok miod@

   remove use of struct nfsm_info in nfs_serv.c
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_mtouio() to nfsd_mtouio()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_strsiz() to nfsd_strsiz()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_dissect() to nfsd_dissect()
   from jsg@; with and ok miod@

    [106 lines not shown]
VersionDeltaFile
1.132.2.2+431-559sys/nfs/nfs_serv.c
1.209.2.1+100-78sys/nfs/nfs_vnops.c
1.49.4.1+85-4sys/nfs/nfsm_subs.h
1.2.2.1+21-30sys/nfs/nfs_srvsubs.c
1.156.2.1+12-19sys/nfs/nfs_socket.c
1.133.2.1+7-5sys/nfs/nfs_vfsops.c
+656-6952 files not shown
+665-7048 files

OpenBSD/src 1oGPYL9sys/dev/ic qwx.c

   properly reset driver and device state if we fail to get RUNNING in qwx_init()
VersionDeltaFile
1.134+40-16sys/dev/ic/qwx.c
+40-161 files

OpenBSD/src OLhgXzxsys/dev/ic qwx.c, sys/dev/pci if_qwx_pci.c

   remove pointless down/up dance in qwx_media_change()

   Already handled by qwx_ioctl() when ieee80211_ioctl() returns ENETRESET.
VersionDeltaFile
1.133+2-20sys/dev/ic/qwx.c
1.37+3-2sys/dev/pci/if_qwx_pci.c
+5-222 files

OpenBSD/src wfRyFDBsys/dev/ic qwx.c

   ensure that qrtr_server state does not race with qwx device during power-on
VersionDeltaFile
1.132+4-4sys/dev/ic/qwx.c
+4-41 files

OpenBSD/src JFR9WXosys/dev/ic qwx.c

   use the ioctl rwlock correctly in qwx_activate()
VersionDeltaFile
1.131+5-3sys/dev/ic/qwx.c
+5-31 files

OpenBSD/src UBRlEWFsys/dev/ic qwx.c

   ensure that rx_ring->bufs_max and freemap are always initialized correctly
VersionDeltaFile
1.130+4-4sys/dev/ic/qwx.c
+4-41 files

OpenBSD/src o3slRl3sys/dev/ic qwx.c

   the qwx init task should not wait for the ioctl lock to become available
VersionDeltaFile
1.129+11-2sys/dev/ic/qwx.c
+11-21 files

OpenBSD/src M9UOOflsys/kern sysv_sem.c sysv_msg.c

   Do not zeroize already zeroed buffer in sysctl_sysvipc(). The
   KERN_SYSVIPC_SEM_INFO case was a part of the big semaphores diff,
   KERN_SYSVIPC_SHM_INFO case to the next one.
   from mvs@; ok deraadt

   Replace semid_ds with semid_ds_kern for in-kernel sysv semaphore
   implementation.
   Note, the buffer used for userland dlivery in sysctl_sysvipc() was
   filled with zeros during allocation, we don't need extra zeroing.
   from mvs@; ok deraadt millert

   Make concurrent sys_msgrcv() wait until we finish message delivery. We
   left acquired message in the queue while we are sleeping in msg_copyout().
   Concurrent sys_msgrcv() could acquire and delete this message.
   Reported-by: syzbot+c80235d951da9769a00f at syzkaller.appspotmail.com
   from mvs@

   Restore msgrcv(2) MSG_NOERROR/E2BIG error path. Silently truncate
   message is not a good idea.

    [74 lines not shown]
VersionDeltaFile
1.66.2.1+119-53sys/kern/sysv_sem.c
1.41.12.1+79-46sys/kern/sysv_msg.c
1.491.2.1+34-11sys/kern/kern_sysctl.c
1.82.2.1+24-7sys/kern/sysv_shm.c
+256-1174 files

OpenBSD/src 6yz7VQrsys/kern sysv_sem.c sysv_msg.c

   Do not zeroize already zeroed buffer in sysctl_sysvipc(). The
   KERN_SYSVIPC_SEM_INFO case was a part of the big semaphores diff,
   KERN_SYSVIPC_SHM_INFO case to the next one.
   from mvs@; ok deraadt

   Replace semid_ds with semid_ds_kern for in-kernel sysv semaphore
   implementation.
   Note, the buffer used for userland dlivery in sysctl_sysvipc() was
   filled with zeros during allocation, we don't need extra zeroing.
   from mvs@; ok deraadt millert

   Make concurrent sys_msgrcv() wait until we finish message delivery. We
   left acquired message in the queue while we are sleeping in msg_copyout().
   Concurrent sys_msgrcv() could acquire and delete this message.
   Reported-by: syzbot+c80235d951da9769a00f at syzkaller.appspotmail.com
   from mvs@

   Restore msgrcv(2) MSG_NOERROR/E2BIG error path. Silently truncate
   message is not a good idea.

    [74 lines not shown]
VersionDeltaFile
1.65.2.1+119-53sys/kern/sysv_sem.c
1.41.8.1+79-46sys/kern/sysv_msg.c
1.483.2.1+35-11sys/kern/kern_sysctl.c
1.81.2.1+24-7sys/kern/sysv_shm.c
+257-1174 files

OpenBSD/src 9uqBKlzsys/dev/ic qwx.c

   do not silently ignore errors which occur in qwx_qmi_fw_init_done()
VersionDeltaFile
1.128+5-5sys/dev/ic/qwx.c
+5-51 files

OpenBSD/ports D7PNLmCdevel/codex distinfo Makefile

   devel/codex: update to 0.144.4
VersionDeltaFile
1.36+2-2devel/codex/distinfo
1.37+1-2devel/codex/Makefile
+3-42 files

OpenBSD/src xGtRxgmsys/kern exec_elf.c kern_exec.c

   sys/exec.h includes machine/exec.h, no need to include both
   from jsg@

   unzero'd padding bytes in struct reg and struct fpreg (both machine dependent)
   leak kernel stack contents.
   from deraadt@; from Andrew Griffiths at Calif

   Disable kbind() and pinsyscalls() for static binaries at the correct
   time, which is inside exec_elf_makecmds().  Amusingly, it looks like
   these protection mechanisms are not needed because other process state
   protects against kbind use since we completed the switch to static pie.
   Also any priviledged static binary (which we ship, setuid or daemon) is
   not going to contain a pinsyscall or kbind slot in the loaded pinsyscalls
   table, so they cannot perform those.  Only synthetic binaries with their
   own pinsyscalls table could play, but of course they won't run with
   priviledge..
   from deraadt@; from Andrew Griffiths at Calif
   ok kettenis, andrew also approves of this approach


    [21 lines not shown]
VersionDeltaFile
1.196.2.1+34-18sys/kern/exec_elf.c
1.268.4.1+25-12sys/kern/kern_exec.c
+59-302 files

OpenBSD/src Vg3EySvsys/kern exec_elf.c kern_exec.c

   sys/exec.h includes machine/exec.h, no need to include both
   from jsg@

   unzero'd padding bytes in struct reg and struct fpreg (both machine dependent)
   leak kernel stack contents.
   from deraadt@; from Andrew Griffiths at Calif

   Disable kbind() and pinsyscalls() for static binaries at the correct
   time, which is inside exec_elf_makecmds().  Amusingly, it looks like
   these protection mechanisms are not needed because other process state
   protects against kbind use since we completed the switch to static pie.
   Also any priviledged static binary (which we ship, setuid or daemon) is
   not going to contain a pinsyscall or kbind slot in the loaded pinsyscalls
   table, so they cannot perform those.  Only synthetic binaries with their
   own pinsyscalls table could play, but of course they won't run with
   priviledge..
   from deraadt@; from Andrew Griffiths at Calif
   ok kettenis, andrew also approves of this approach


    [21 lines not shown]
VersionDeltaFile
1.194.2.1+34-18sys/kern/exec_elf.c
1.268.2.1+25-12sys/kern/kern_exec.c
+59-302 files

OpenBSD/src AiSZE6iusr.bin/tmux window-copy.c

   Handle padding and tab redraw correctly in copy mode.
VersionDeltaFile
1.419+16-3usr.bin/tmux/window-copy.c
+16-31 files

OpenBSD/ports DSMbcAYnet/mattermost-server distinfo Makefile, net/mattermost-server/pkg PLIST-main

   Update mattermost 11.7.2 -> 11.9.0
   Changelog: https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html
VersionDeltaFile
1.17+738-732net/mattermost-server/pkg/PLIST-main
1.90+4-4net/mattermost-server/distinfo
1.102+1-1net/mattermost-server/Makefile
+743-7373 files

OpenBSD/ports GrXdyOrdevel Makefile

   +devel/mips-elf
VersionDeltaFile
1.2595+1-0devel/Makefile
+1-01 files