net/samba425: update to 4.25.1
* BUG 16274: CTDB: Cannot find device "<iface>@<link>": need to extract real
interface names
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16261: Rename with ReplaceIfExists to a target differing only in case
creates a duplicate instead of replacing (regression in
* BUG 16263: Samba 4.25.0 fails to build on macOS
* BUG 16258: Python smbconf transaction_start() lacks a talloc stack frame
with CTDB
* BUG 16265: Linux i686 build fails on dynamic_lookup
* BUG 16276: Access control bypass via vfs_ceph_rgw case-insensitive open
(CVE-2026-109411)
* BUG 16287: vfs_acl_xattr crashes on zero-sized flistxattr queries
* BUG 16235: Dynamic interface support in smbd is racy
* BUG 16254: CTDB database operations can be run against incorrect nodes
* BUG 16273: A node can be banned because it tries to run recovery after
losing the cluster lock
* BUG 15857: All backend log should honor global log level "log level = "
[6 lines not shown]
[compiler-rt][test] Fix sanitizer_coverage_trace_pc_guard-init.cpp on Android (#235625)
Use `%dynamiclib1` and `%ld_flags_rpath_so1`/`%ld_flags_rpath_exe1` so
`DT_NEEDED` does not record the host path to the shared library.
Fixes test failure on
https://lab.llvm.org/buildbot/#/builders/sanitizer-x86_64-linux-android
Assisted-by: Gemini
[Offload] Add properties to olGet*Info to retrieve native handles (#234186)
Adds a property to be able to retrieve the native handle of a queue,
device and context to their respective olGetInfo routines.
This is needed to implement interopability features on top of liboffload
like OpenMP's interop directive.
Assisted by Claude.
[mlir][linalg] Remap linalg.index when packing a structured op (#221430)
## Problem
Packing a structured operation splits an original loop dimension `d`
into outer and inner dimensions. The operation's region is moved to the
packed `linalg.generic` unchanged, so `linalg.index d` starts returning
only the outer tile coordinate.
The resulting IR verifies, but silently computes incorrect index values.
## Approach
Track the inner loop dimension introduced for each packed loop and
rewrite:
linalg.index d
to:
[20 lines not shown]
[CodeGen] Don't fold a load into an inline asm that may overwrite it
The peephole optimizer folds a load from a stack slot into a foldable
inline asm operand, which then reads the slot itself. An asm that writes
the slot first (through an early-clobber "=&m" output) then read what it
wrote, so a load isn't folded into an asm that stores, unless the slot
is invariant. Nor is a load that doesn't fill the register, e.g. a
32-bit load into an XMM register, since the asm would read the whole
register's worth of memory.
Assisted-by: Claude Opus 5.5
[CodeGen] Keep an inline asm's memory accesses described after a fold
The memoperands of an instruction describe all of its memory accesses.
Folding gave an inline asm a single memoperand, for the stack slot,
which said that it accessed no other memory even when it had an "m"
operand or a "memory" clobber. Without memoperands, the asm was taken to
access any memory, so it now gets one for any memory as well.
Assisted-by: Claude Opus 5.5
[CodeGen] Prefer spilling a register an inline asm can fold
InlineSpiller rematerialized a value passed to a foldable inline asm
operand (e.g. a constant) into a register right before the asm, which
the asm may not have had, since registers running out is why the value
was spilled. It's now spilled and folded instead.
An asm that can fold a register also no longer adds to the register's
spill weight, since it needs no reload or spill for it. The allocator
then spills that register before the asm's other operands, which need
registers, which saves spills in two_tied_rm and tied_rm_undef.
Assisted-by: Claude Opus 5.5
[CodeGen] Fold an inline asm subregister operand at its slot offset
A stack slot holds the whole register, and a folded operand referred to
the start of the slot, so a subregister was folded only if it was at
offset 0, and other subregisters got a reload into a register the asm
may not have. Coalescing can turn an i686 "rm" byte operand into
sub_8bit_hi of a GR32, which is at byte 1. Fold a subregister at its
offset in the slot, from getStackSlotRange(), so
getFrameIndexOperands() now takes an offset.
Also add a third asm to qm_tied_high_byte, which clobbers every GPR, so
that it reaches the folder. Without it, the value is reloaded into a
register that's free at the second asm.
Assisted-by: Claude Opus 5.5
[CodeGen] Fold every operand of a register into an inline asm
The spill weights took a register to be foldable into an asm if any one
of its operands there was foldable, while the folder needs all of them
to be. One value passed to an "rm" and an "r" operand could then get
spilled, not folded, and the asm ran out of registers. Add
MachineInstr::mayFoldInlineAsmReg(), true if every operand of a register
in an asm can be folded, and use it in the folder and CalcSpillWeights.
The folder now folds every operand of the register, including an undef
use that InlineSpiller leaves out of the operands it passes, which was
left behind still referring to the spilled register.
Nothing in tree marks an inline asm operand foldable until #229632, so
the tests set the "foldable" flag in MIR. Also define ALL_GPRS in
greedy-inline-asm-fold.mir, and drop -verify-machineinstrs, which llc
runs anyway.
Assisted-by: Claude Opus 5.5
Move the later folding fixes to their own PRs
1d50fec74e60 added more fixes for folding inline asm register operands
to this PR. They're split into the PRs stacked on this one, one fix
each, to keep this one to the tied operand fix that was reviewed.
This reverts commit 1d50fec74e601c10811a0d58c37a392b2a1ba146.
Assisted-by: Claude Opus 5.5
[compiler-rt][test] Disable sanitizer_coverage_inline8bit_counter_default_impl.cpp on Android (#235620)
`android_run.py` does not copy files created on the device back to the
host.
Fixes test failure on
https://lab.llvm.org/buildbot/#/builders/sanitizer-x86_64-linux-android
Assisted-by: Gemini
Reland "[MISched] Add anti-dependency breaking to PostMachineScheduler" (#235613)
This relands #231790 which was reverted in #235595 because of CI
failures caused by `llvm/test/CodeGen/RISCV/postmisched-antidep.ll`.
Original commit message:
----
Port the post-RA anti-dependency breaker lifecycle to ScheduleDAGMI so
PostMachineScheduler can rename physical registers across scheduling
regions. Drive the StartBlock/Observe/BreakAntiDependencies/FinishBlock
sequence from the DAG, selecting the aggressive or critical breaker from
the subtarget's anti-dependency mode.
Add the -misched-postra-antidep override so the machinery can be tested
with llc, and cover a within-region WAR hazard with a RISC-V test that
contrasts the ANTIDEP and NO-ANTIDEP results.
[6 lines not shown]
p5-Starman: update to 0.4019.
0.4019 2026-10-24 02:02:21 PDT
[SECURITY]
- Stream chunked request bodies to the temporary buffer instead of
holding whole chunks in memory (CVE-2026-115824)
- Parse chunk-size lines in linear time with a 4 KiB length limit and
strict syntax; malformed lines get 400 (CVE-2026-115822)
- Do not send a response body for HEAD requests or 1xx, 204 and 304
responses, on both the array and streaming paths (CVE-2026-115823)
- Limit how long a request body may take to arrive: --read-timeout
(default 5 seconds) now also applies to each wait for more of the
body, and the new --body-timeout option limits the total time
(default 300 seconds; raise it or set it to 0 for slower uploads).
Expiry gets 408 (CVE-2026-115817)
- Reject Transfer-Encoding other than "chunked" (400/501) and close
the connection after a request with both Transfer-Encoding and
Content-Length. Completes the fix for CVE-2026-40560
- Reject malformed, negative and conflicting Content-Length headers
[24 lines not shown]
[LSR][RISCV] Prefer equality loop exits for Zibi (#225619)
RISC-V Zibi has immediate forms only for equality branches. This teaches
LSR to rewrite eligible relational latch exits to `eq`/`ne` when TTI
says the final immediate is profitable.
RISC-V enables it for Zibi immediates while leaving comparisons that
already use `x0` unchanged. The SCEV check uses the recurrence period
rather than poison-derived nowrap flags.
Tests cover unit and non-unit strides, negative cases, and generated
`bnei` code.
Fixes #225627.
p5-Plack: update to 1.0057.
1.0057 2026-10-24 02:01:28 PDT
[BUG FIXES]
- Fix Plack, Plack::Request and Plack::Response in 1.0056 still declaring $VERSION 1.0055,
which kept PAUSE from indexing 1.0056. This release contains the same fixes as 1.0056,
including CVE-2026-115825
1.0056 2026-10-24 01:55:22 PDT
[SECURITY]
- Fix HTTP::Server::PSGI allocating a buffer as large as the declared Content-Length,
which let a single request crash the server with "Out of memory!" (CVE-2026-115825)
[BUG FIXES]
- Fix HTTP::Server::PSGI passing bytes after the Content-Length body to the app in psgi.input
- Fix HTTP::Server::PSGI accepting malformed, negative, duplicate or too long (more than
18 digits) Content-Length. Such requests now get 400 Bad Request
- Fix HTTP::Server::PSGI ignoring Transfer-Encoding and passing the raw chunked body to the app.
Such requests now get 501 Not Implemented
- Fix HTTP::Server::PSGI passing stray bytes after the headers as psgi.input when the request
[13 lines not shown]
