Bound vulnerability database handling
The audit updater writes an unbounded remote download and decompressed
output before validation. An HTTP attacker can fill temporary or package
database storage.
Set fixed maxima and also limit each stage to half its filesystem.
Build a temporary database and atomically replace the existing one after
success.
Drop privileges in sandboxed callbacks
The callback sandbox processes untrusted archive and signature parsers
after forking, but retains root identity. It also inherits a descriptor
for /, so Capsicum alone does not remove root filesystem authority.
Drop to nobody before entering Capsicum, matching the string-returning
callback path.
[x86] Handle implicit sections when determining if a global is large (#206210)
Just like explicit sections.
We were seeing globals with implicit sections marked large under the
medium code model.
Reland of #204247, with a fix to not crash on declarations with an
explicit section. Implicit sections are not applied to declarations, so
don't check isDeclarationForLinker() globals for implicit sections.
Assisted-by: Gemini
[docs] Clean up migrated Clang InternalsManual markup
Replace migrated blockquote markup in InternalsManual.md with MyST definition lists where the surrounding text is semantically a term-and-definition list.
[docs] Rename selected Clang docs to Markdown
Rename 18 Clang documentation files from .rst to .md. The clang-format generated docs are split into users/rnk/clang-format-md-rename and users/rnk/clang-format-md-write for separate review.
[SLP]Remove accidental commenting out the code
Removed the accindentally commented out code, causing regressions with
ordered reductions
Reviewers:
Pull Request: https://github.com/llvm/llvm-project/pull/211662
Fix namespace listing for old NVMe devices
Commit 9e1db51d4b5fc made nvmecontrol devlist get list of active
namespaces from the device instead of iterating through all possible
IDs. The problem is that this request is not supported before NVMe
1.1, and in particular by Intel Optane 905P drives. This change
reintroduces iteration for devices before NVMe 1.2.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58010
[SSAF] Fix a stage2 test failure with ASan-instrumented clang (#211432)
ASan emits a symbol for a static global in `TestTransformation.cpp` that
causes link issues in green dragon.
Added `__attribute__((no_sanitize("address")))` to that static global to
fix the test.
rdar://182623740
Merge tag 'v7.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- Fix leak in cifs_close_deferred_file()
- Fix resolving MacOS symlinks
- Fix stale file size in readdir
- Update git branches in MAINTAINERS file
- Fix bounds check in cifs_filldir
- Fix checks in parse_dfs_referrals()
- Fix DFS referral checks for malformed packet
* tag 'v7.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
cifs: prevent readdir from changing file size due to stale directory metadata
smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
Add missing git branch info for cifs and ksmbd to MAINTAINERS file
smb: client: bound dirent name against end of SMB response in cifs_filldir
smb: client: validate DFS referral PathConsumed
[NFC][AMDGPU] Remove unused -SDAG test suffixes from minimumnum/maximumnum (#211634)
Test checks diff is automatically generated using
`update_llc_test_checks.py`
Discussed in https://github.com/llvm/llvm-project/pull/207896
[mlir][xegpu] Support N-D block transfers in VectorToXeGPU (#210527)
Extend the vector.transfer_read/transfer_write lowerings so they can
produce N-D xegpu.load_nd/store_nd, not just 1D/2D, and relax the
out-of-bounds handling to match load_nd's implicit-zero padding.
Restructure both patterns as "block first, then scatter as fallback.
---------
Co-authored-by: Claude Opus 4.8 <noreply at anthropic.com>
[mlir][OpenACC] Emit multi-IV tile and element loops from ACCLoopTiling (#211651)
`ACCLoopTiling` used to lower an N-dimensional `tile()` clause by
*uncollapsing* the fused loop into a deep nest of single-IV `acc.loop`s
(`tile_1 → … → tile_N → elem_1 → … → elem_N`). This discards the natural
grouping of the tile clause: the 2N single-IV loops no longer express
"these are the tile iterations" and "these are the in-tile iterations"
as collapsible units, and gang/vector end up spread across a deep nest
where only the outermost loop of each group carries the attribute. This
could potentially lead to poor parallelism assignment.
With this MR:
`tileACCLoops` now rewrites the single fused `acc.loop` in-place into
exactly two multi-IV loops, each carrying all the tiled induction
variables:
- a **tile-group** loop whose steps are the original steps scaled by the
tile sizes, and
- a nested **element-group** loop that walks the iterations within one
tile, with upper bounds clamped to `min(origUB, tileStart +
[17 lines not shown]
[mlir][acc] Allow for existing declare globals in GPU module under unified memory. (#211650)
OpenACC declare globals may already exist in the GPU module from earlier
GPU lowering. Under unified memory, this pass expects those device
copies as declarations, but a pre-existing global may still have an
initializer and therefore not match.
This change adapts an otherwise equivalent existing GPU global to
declaration form and reuses it; A lit test covers a host/GPU declare
global that should be reused as a declaration in the GPU module.
tests/sys/pmc: only build if MK_PMC != no
This unbreaks the build when pmc support is explicitly disabled via the
aforementioned build knob.
MFC after: 10 days
Fixes: 2cfd82f74 ("hwpmc: add regression tests for ...")
Differential Revision: https://reviews.freebsd.org/D58401
[LICM] Allow hoisting of InsertElementInst's past non-hoistable InsertElementInsts (#211414)
When building vectors from multiple scalars in a loop, allow the
insertions using invariant data to be hoisted, even if blocked by the
variant insertions.
In the SLP vectorizer, c1b37eacbf makes the assumption that these build
vectors will properly be hoisted, when they are not leads to regressions
such as #195497.
Reland of #200532.
Assisted By: Codex
Co-authored-by: Luke Lau <luke_lau at icloud.com>
Co-authored-by: Nikita Popov <github at npopov.com>
