BSD Commit Log Search

   recognise C2-Ultra (Canyon)

   add a "hexdump" export mode that dumps the key blob in hex
   format. Very useful when writing internet-drafts.

   E.g. ssh-keygen -em hexdump -f /path/key

   drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile

   From Fangzhi Zuo
   4628e40c9ca79c7ca6d55ee0d5da1839c2d0b4c7 in linux-6.18.y/6.18.50
   7a4dd08c3f921576c6a7524f60e4f0e4601835d2 in mainline linux

   drm/amd/display: hide Apple Studio Display secondary tile

   From Jerry Zuo
   7d860bed133698eefa7f5f808c7dbce1c2738b96 in linux-6.18.y/6.18.50
   49521be4809d63fe3efb6bc68ee11cb1e1ef3d63 in mainline linux

   drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)

   From Timur Kristof
   c6b915f0df31121524253f1410da7b3dd43e92b7 in linux-6.18.y/6.18.50
   8223a605744bb471f31018eac9075a539415b16f in mainline linux

   drm/amd/display: Skip PHY SSC reduction on some 8K panels

   From Roman Li
   a1fa3d1197cc2a5d8d55f9cab8bb07c3367431ec in linux-6.18.y/6.18.50
   144169e7be0831e09958a906d08d1856751aa6c6 in mainline linux

   drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

   From Srinivasan Shanmugam
   2ab18de5ebb11c76bfc8087c5a09fbcccd0dea8a in linux-6.18.y/6.18.50
   4ae3e16f4b3bf64140f773629b765d605ee079a9 in mainline linux

   avoid an uninitialised stack read

   it is possible for bios_sysctl() to be called with namelen=0:
   sys_sysctl() name={ CTL_MACHDEP, CPU_BIOS }, namelen=2
   cpu_sysctl() name={ CPU_BIOS }, namelen=1
   bios_sysctl()        name={}, namelen=0

   if name[0] was 2 (BIOS_DISKINFO) the function would not return ENOTDIR
   as intended

   found by and diff from Johann Hoepfner, ok deraadt@

   In usbd_fill_deviceinfo(), clear all memory which removes potential
   padding artifacts, and simplifies the function substantially
   ok kettenis kirill

   If we're hibernating we need to load the firmware after we resume.  This
   also means that we should clean up before we hibernate to make sure we
   don't do stupid stuff like polling sensors before the firmware gets
   loaded.

   ok mglocker@

   Add a global sleep mode variable that indicates whether we're hibernating
   or doing a "normal" suspend.

   ok mglocker@

   Add '-p' to sftp mkdir/lmkdir to create directories as required

   The -p option causes the mkdir and lmkdir commands to create any missing
   intermediate directories. If '-p' is specified, it is not considered an
   error if a directory already exists.

   With / OK djm@

   execvp(3) against a constant absolute path is not needed, use execv(3)
   instead.

   Use getexecpath(3) and thus execv(3) in the same way as other privsep
   fork+execsame daemons.

   use getexecpath(3) and execv(3)
   ok rsadowski

   rpki-client: expand explanatory comment for CMS_verify() slightly

   Error on invalid relative targets, such as +foo or -0. GitHub issue 5576
   from imcusg at gmail dot com.

   Do not silently make a session monitor if the target is unknown, GitHub
   issue 5575 from zzchun12826 at gmail dot com.

   relayctl: rename "empty" to "unavailable" in table status

   The word empty suggested the table has no hosts configured. It really means
   the table has no hosts currently up, so unavailable describes the state more
   clearly.

   OK kirill@

   rpki-client: split a large chunk of cms_parse_validate() into a helper

   There is a huge messy part in the CMS validation code that deals with
   things needing the SignerInfo (the OpenSSL version of it, that is).
   All this stuff does not need cleanup at exit and is very long, boring
   and meandering code which is concerned with requirements from RFC 6488
   which are largely independent of the econtent validation and parsing.

   So pull all this into a helper and pass in the few things we need.
   The only info we want to retain is that the object is well-formed and
   its signtime. Since we need to pass in the cert, we call the helper
   after extraction and before validation of the signtime against the cert.

   The main point is that cms_parse_validate() finally becomes somewhat
   manageable in size.

   ok job

   Add proper program bound checks to the bpf engine

   Introduce new bpf functions _bpf_lfilter and bpf_lfilter which properly
   bound check the bpf program and ensure that no jump instruction goes
   out of bound. The old bpf_filter and _bpf_filter functions pass a len of
   zero and bypass the bound checks.

   In the kernel bpf_mfilter now uses the bpf_program (which includes the len)
   and by that all calls are bounded.
   In userland pcap_offline_filter uses now bpf_lfilter and is bounded.
   Direct calls to bpf_filter and _bpf_filter don't do bound checking and
   should no longer be used. These functions will be removed from our libpcap
   soon.

   Fix for libpcap CVE-2026-31912.

   Fix various minor things in our bpf implementation

   In userland it is possible to call bpf_filter / pcap_offline_filter
   with unverified bpf programs. Because of this harden bpf_filter further
   by adding the following extra checks:

   - Ensure that load and store operations to the scratch memory store are
   always bound checked.
   - Ensure that no division or modulo by zero is done.
   - No longer do shift operations with a too large shift exponent. Instead
   zero out the result.
   - No longer call abort on unknown instructions when bpf_filter is run
   in userland. Use the same return 0 as is already done in the kernel.

   On top of this ensure that no unhandled instruction encoding makes it
   through bpf_validate by using the same case handling as bpf_filter.

   This are fixes for libpcap CVE-2026-0799, CVE-2026-6244, CVE-2026-6554,
   CVE-2026-31911.  None of the above CVEs are applicable to or kernel since

    [2 lines not shown]

   libfido2: recovery hardcoded USB metadata

   OK: djm@

   remove unused local variable; ok deraadt@

   correct relay_httpmethod_byname() prototype

   return type is enum httpmethod not u_int

   correct server_httpmethod_byname() prototype

   return type is enum httpmethod not unsigned int

   correct json_parse_response() prototype

   return type changed from int to enum chngstatus in json.c rev 1.11

   Add Gimli, Manitoba, site of the Gimli Glider landing.

   sys/uvm: validate anonymous object pager requests

   uao_get() trusts the requested page range before allocating pages and
   looking up swap slots; an invalid request can therefore allocate a page
   outside the object and read beyond its swap slot array. Validate the
   request before page lookup or allocation, preserving optional fault
   clustering at the object boundary.

   Reject nonpositive page counts and starting page indices outside the
   object; require the entire range for PGO_ALLPAGES, or a centeridx within
   both the request and the object otherwise. Compare against the remaining
   page count in voff_t and derive pageidx from the validated firstpage,
   avoiding overflow in the bounds check and unchecked narrowing.

   Reported by Andrew Griffiths, thanks!

   OK: kettenis@

   Fix resuming the secondary CPUs when resuming from hibernation.  Like on
   amd64, park the CPUs before unpacking the hibernate image.  On arm64 we
   park the CPUs somewhere safe in the kernel.  When we unpark the CPUs,
   we need to locate its struct cpu_info and stack as these are dynamically
   allocated and the booted kernel may have allocated them in a different
   location.

   ok deraadt@