OpenZFS/src 904d432module/zfs dmu_objset.c

dmu_objset_open_impl: unregister prop callbacks on error

If dsl_prop_register() fails partway, the error path frees the objset
without removing the callbacks already registered, leaving records
that point at freed memory.  Call dsl_prop_unregister_all() first.

Reviewed-by: Tony Hutter <hutter2 at llnl.gov>
Reviewed-by: Alexander Motin <alexander.motin at TrueNAS.com>
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Martin Minkus <martin.minkus at gmail.com>
Closes #18903
DeltaFile
+1-0module/zfs/dmu_objset.c
+1-01 files

FreeBSD/ports 011be70lang/elixir-mode.el pkg-plist Makefile

lang/elixir-mode.el: Update to 2.5.0

Upstream added elixir-format.el, so pick it up in pkg-plist. Switch to
DISTVERSION for the ordering expected alongside DISTVERSIONPREFIX.
DeltaFile
+3-2lang/elixir-mode.el/distinfo
+1-2lang/elixir-mode.el/Makefile
+1-0lang/elixir-mode.el/pkg-plist
+5-43 files

FreeBSD/ports 01d171ewww/yaws Makefile distinfo

www/yaws: Update to 2.3.1
DeltaFile
+3-3www/yaws/distinfo
+1-1www/yaws/Makefile
+4-42 files

FreeBSD/ports 404e43fdevel/rebar3 Makefile distinfo

devel/rebar3: Update to 3.27.0
DeltaFile
+3-3devel/rebar3/distinfo
+1-1devel/rebar3/Makefile
+4-42 files

LLVM/project bf4e08dllvm/lib/Target/AMDGPU SIISelLowering.cpp AMDGPULowerBufferFatPointers.cpp

[AMDGPU] Track buffer resource num_records width in a subtarget field (#217136)

Replace the boolean 45-bit-num-records-buffer-resource subtarget
feature's `Has45BitNumRecordsBufferResource` flag with a numeric
`BufferResourceNumRecordsWidth` field.

AI disclosure: Code by Claude, comments and wordings by me

---------

Co-authored-by: Lukas Sommer <lukas.sommer at amd.com>
DeltaFile
+24-12llvm/lib/Target/AMDGPU/AMDGPU.td
+13-0llvm/lib/Target/AMDGPU/GCNSubtarget.h
+1-1llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+1-1llvm/lib/Target/AMDGPU/AMDGPULowerBufferFatPointers.cpp
+1-1llvm/lib/Target/AMDGPU/AMDGPULegalizerInfo.cpp
+40-155 files

OPNSense/core 79045e2src/etc/inc interfaces.inc, src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms dialogWireless.xml

Interfaces: Wireless: Devices - Migrate to MVC code, second phase, move settings from Interfaces into Wireless. for https://github.com/opnsense/core/issues/10751

Move all settings from interface.XXX.wireless to wireless.clone and cleanup code referencing the old spot.

console : seemed to show the parent interfaces, but without a useful implementation, removed it
DeltaFile
+0-999src/www/interfaces.php
+356-3src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogWireless.xml
+182-1src/opnsense/mvc/app/models/OPNsense/Interfaces/Wireless.xml
+32-133src/etc/inc/interfaces.inc
+101-0src/opnsense/mvc/app/models/OPNsense/Interfaces/Migrations/WIFI1_0_0.php
+61-0src/opnsense/scripts/interfaces/list_regdomain.py
+732-1,1364 files not shown
+788-1,16510 files

OPNSense/core 89fe70dsrc/etc/inc interfaces.inc, src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms dialogWireless.xml

Interfaces: Wireless: Devices - Migrate to MVC code, second phase, move settings from Interfaces into Wireless. for https://github.com/opnsense/core/issues/10751

Move all settings from interface.XXX.wireless to wireless.clone and cleanup code referencing the old spot.

console : seemed to show the parent interfaces, but without a useful implementation, removed it
DeltaFile
+0-999src/www/interfaces.php
+356-3src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogWireless.xml
+182-1src/opnsense/mvc/app/models/OPNsense/Interfaces/Wireless.xml
+32-133src/etc/inc/interfaces.inc
+101-0src/opnsense/mvc/app/models/OPNsense/Interfaces/Migrations/WIFI1_0_0.php
+61-0src/opnsense/scripts/interfaces/list_regdomain.py
+732-1,1364 files not shown
+788-1,16510 files

LLVM/project be99215flang/lib/Semantics resolve-directives.cpp, flang/test/Lower/OpenACC acc-copy-reduction.f90

[flang][OpenACC] Allow data action and data-sharing clause overlap (#218588)

The changes I made in https://github.com/llvm/llvm-project/pull/211606
disallowed multiple different data actions clauses to occur on the same
variable in the same construct. This PR fixes that mistake reducing the
only restriction to multiple different data sharing clauses (and the
reduction clause) can not be placed on the same object in the same
construct.
DeltaFile
+94-0flang/test/Semantics/OpenACC/acc-data-action-overlap.f90
+62-0flang/test/Semantics/OpenACC/acc-copy-reduction.f90
+4-49flang/lib/Semantics/resolve-directives.cpp
+24-0flang/test/Semantics/OpenACC/acc-dataclause-dedup.f90
+12-6flang/test/Lower/OpenACC/acc-copy-reduction.f90
+4-8flang/test/Semantics/OpenACC/acc-default-none-arrays.f90
+200-636 files

LLVM/project 652b55dllvm/lib/Target/AArch64 AArch64PointerAuth.cpp

[llvm][AArch64] Simplify reverse iteration fix in #217752. NFC (#217979)

This is a follow-up to ab0b549b6b9855e176f6f7ea3f9e5ffe930061c6 where
vhscampos noticed that we were skipping MBBI in the backward search for
SP adjustment FrameDestroy instructions. Since MBB always points at the
PAUTH_EPILOGUE pseudo, there is no functional difference in this change,
but it's worth simplifying that because the intent does not look obvious
from construction, and we don't lose much from iterating over one extra
instruction.
DeltaFile
+1-1llvm/lib/Target/AArch64/AArch64PointerAuth.cpp
+1-11 files

FreeBSD/src 6269b9bsys/kern tty.c

tty: Revalidate after dropping the tty lock in ioctl handlers

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock.  After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session.  This race can be exploited to escalate privileges.

TIOCSPGRP has a similar race, fix that too.

Approved by:    so
Security:       FreeBSD-SA-26:62.tty
Security:       CVE-2026-58093
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59126
DeltaFile
+12-2sys/kern/tty.c
+12-21 files

FreeBSD/src 9e9609acrypto/openssl/crypto/cmp cmp_vfy.c, crypto/openssl/crypto/cms cms_kari.c

openssl: Fix multiple vulnerabilities

This is a rollup commit from upstream to fix:
  Avoid full read buffer allocation when buffering DTLS records
  ssl/record: lower the DTLS unprocessed_rcds queue limit
  Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
  Add a test for restricting growth in cmp cert cache
  Fix unbounded cert cache growth in cmp
  Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

Approved by:    so
Obtained from:  OpenSSL
Security:       FreeBSD-SA-26:61.openssl
Security:       CVE-2026-54874
Security:       CVE-2026-63072
Security:       CVE-2026-63074
Security:       CVE-2026-63076
DeltaFile
+348-0crypto/openssl/test/cmp_extracerts_dos_test.c
+88-32crypto/openssl/ssl/record/rec_layer_d1.c
+14-1crypto/openssl/crypto/cmp/cmp_vfy.c
+8-4crypto/openssl/ssl/record/ssl3_record.c
+10-1crypto/openssl/ssl/record/record_local.h
+8-1crypto/openssl/crypto/cms/cms_kari.c
+476-394 files not shown
+488-4310 files

FreeBSD/src e6c1c92sys/dev/sound/pcm channel.h dsp.c

dsp: Fix a potential use-after-free in dsp_oss_syncstart()

This function has a loop where it attempts to lock all channels in a
group.  If doing so would block, it releases all locks, sleeps for a
bit, and tries again.  However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again.  I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels.  Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Approved by:    so
Security:       FreeBSD-SA-26:58.sound
Security:       CVE-2026-58091
Reported by:    Hazley Samsudin of GovTech CSG
Reviewed by:    christos
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58912
DeltaFile
+6-11sys/dev/sound/pcm/dsp.c
+5-4sys/dev/sound/pcm/channel.h
+11-152 files

FreeBSD/src 6bfd894sys/kern uipc_shm.c, sys/sys mman.h

posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler

The check for whether shm_lp_psind was assigned was unlocked.  This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated.  This in turn can be used to
escalate privileges.

Fix this by acquiring the rangelock earlier.  In shm_mmap_large(),
assert that we hold the rangelock.  In shm_write(), annotate an unlocked
load of shm_lp_psind.

Approved by:    so
Security:       FreeBSD-SA-26:63.posixshm
Security:       CVE-2026-58094
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59104
DeltaFile
+17-10sys/kern/uipc_shm.c
+1-1sys/sys/mman.h
+18-112 files

FreeBSD/src 5eaecdbsys/dev/hwpmc hwpmc_mod.c, sys/kern kern_exec.c

hwpmc: Fix the execve handler

When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs.  This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().

Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so.  It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug().  Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.

I think this check is trying to be too clever.  Let's make it simpler:
simply do not attach PMCs unless the owner is privileged.  This is how,
e.g., ktrace works.  I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.

    [11 lines not shown]
DeltaFile
+12-60sys/dev/hwpmc/hwpmc_mod.c
+1-1sys/kern/kern_exec.c
+13-612 files

LLVM/project 2da5cc7clang/lib/CIR/Dialect/Transforms CallConvLoweringPass.cpp, clang/test/CIR/CodeGen call-conv-lowering-x86_64-empty.cpp

[CIR] Accept a union with an ABI-empty member

isSupportedType rejected any union containing an ABI-empty member outright.
Dropping the reject alone is not enough.  A union mixing a data-free member
that spans the record with a bit-field access unit can still mis-lower.  The
new accept rule requires that a data-supplying member span the record
whenever a bit-field access unit is present.

mapCIRType's union loop now only maps members that hold data for the ABI,
so an unnamed bit-field's storage is not mapped as a field either.

Assisted-by: Cursor / claude-opus-5
DeltaFile
+226-0clang/test/CIR/Transforms/abi-lowering/x86_64-union.cir
+92-0clang/test/CIR/CodeGen/call-conv-lowering-x86_64-empty.cpp
+14-18clang/test/CIR/Transforms/abi-lowering/x86_64-aggregate-nyi.cir
+19-10clang/lib/CIR/Dialect/Transforms/CallConvLoweringPass.cpp
+351-284 files

LLVM/project 23e604dlibcxx/docs ABIGuarantees.rst Hardening.rst

[libc++][docs] Document `std::optional` hardening (#218173)

Resolves #218041
DeltaFile
+7-1libcxx/docs/Hardening.rst
+2-2libcxx/docs/ABIGuarantees.rst
+9-32 files

LLVM/project 6a65e84libcxx/include/__configuration availability.h, libcxx/utils/libcxx/test/features availability.py

[libc++] Add availability for LLVM 22 on Apple platforms (#218518)
DeltaFile
+17-3libcxx/include/__configuration/availability.h
+1-1libcxx/utils/libcxx/test/features/availability.py
+18-42 files

NetBSD/src fpbJwGvsys/arch/riscv/riscv bus_space_generic.S

   riscv: No need for the panic calls in bus_space_generic when not DIAGNOSTIC
VersionDeltaFile
1.8+22-3sys/arch/riscv/riscv/bus_space_generic.S
+22-31 files

NetBSD/src CIzIP1rsys/arch/riscv/riscv bus_space_generic.S

   Revert previous now that ENTRY_NP is fixed.
VersionDeltaFile
1.7+2-12sys/arch/riscv/riscv/bus_space_generic.S
+2-121 files

LLVM/project 0daa20dclang/lib/CIR/CodeGen CIRGenBuiltinAArch64.cpp, clang/lib/CodeGen/TargetBuiltins ARM.cpp

[AArch64][llvm][clang] Add missing sv{set,get,dup}_neonq_mf8 intrinsics (#217577)

Add support for `svset_neonq_mf8`, `svget_neonq_mf8` and `svdup_neonq_mf8`
intrinsics, which are present in the ACLE but were not implemented in llvm.
DeltaFile
+16-0clang/test/CodeGen/aarch64_neon_sve_bridge_intrinsics/acle_neon_sve_bridge_dup_neonq.c
+14-1clang/test/CodeGen/aarch64_neon_sve_bridge_intrinsics/acle_neon_sve_bridge_get_neonq.c
+14-0clang/test/CodeGen/aarch64_neon_sve_bridge_intrinsics/acle_neon_sve_bridge_set_neonq.c
+13-0clang/lib/Headers/arm_neon_sve_bridge.h
+6-3clang/lib/CodeGen/TargetBuiltins/ARM.cpp
+3-0clang/lib/CIR/CodeGen/CIRGenBuiltinAArch64.cpp
+66-42 files not shown
+72-48 files

FreeBSD/src 5990860sys/kern uipc_shm.c, sys/sys mman.h

posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler

The check for whether shm_lp_psind was assigned was unlocked.  This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated.  This in turn can be used to
escalate privileges.

Fix this by acquiring the rangelock earlier.  In shm_mmap_large(),
assert that we hold the rangelock.  In shm_write(), annotate an unlocked
load of shm_lp_psind.

Approved by:    so
Security:       FreeBSD-SA-26:63.posixshm
Security:       CVE-2026-58094
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59104
DeltaFile
+17-10sys/kern/uipc_shm.c
+1-1sys/sys/mman.h
+18-112 files

FreeBSD/src c7cec6fsys/kern tty.c

tty: Revalidate after dropping the tty lock in ioctl handlers

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock.  After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session.  This race can be exploited to escalate privileges.

TIOCSPGRP has a similar race, fix that too.

Approved by:    so
Security:       FreeBSD-SA-26:62.tty
Security:       CVE-2026-58093
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59126
DeltaFile
+12-2sys/kern/tty.c
+12-21 files

FreeBSD/src edff72esys/dev/sound/pcm channel.h dsp.c

dsp: Fix a potential use-after-free in dsp_oss_syncstart()

This function has a loop where it attempts to lock all channels in a
group.  If doing so would block, it releases all locks, sleeps for a
bit, and tries again.  However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again.  I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels.  Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Approved by:    so
Security:       FreeBSD-SA-26:58.sound
Security:       CVE-2026-58091
Reported by:    Hazley Samsudin of GovTech CSG
Reviewed by:    christos
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58912
DeltaFile
+6-11sys/dev/sound/pcm/dsp.c
+5-4sys/dev/sound/pcm/channel.h
+11-152 files

FreeBSD/src ae27dffsys/sys ucred.h, tests/sys/mac/do Makefile regression.c

cred: Fix group_is_primary()

This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group.  If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.

group_is_primary() has exactly one use, in mac_do.  There, it's used to
determine whether to keep the caller's current primary groups.  This
means that a rule such as gid=0>uid=0 will permit any credential with no
supplementary groups.

I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).

Fix group_is_primary(), and add a regression test.

    [9 lines not shown]
DeltaFile
+83-0tests/sys/mac/do/regression.c
+1-1sys/sys/ucred.h
+2-0tests/sys/mac/do/Makefile
+86-13 files

FreeBSD/src c5ad29ccrypto/openssl/ssl/quic quic_port.c quic_txp.c, crypto/openssl/ssl/record/methods dtls_meth.c

openssl: Fix multiple vulnerabilities

This is a rollup commit from upstream to fix:
  Handle signature_algorithms_cert extension in key-only context
  Avoid double free of qrx in port_default_packet_handler()
  Avoid full read buffer allocation when buffering DTLS next-epoch records
  ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit
  ssl/record: remove dead DTLS processed_rcds record queue
  Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
  CMP unexpected sender DN used as format string in ERR_raise_data()
  Add test for CVE-2026-63073
  Add a test for restricting growth in cmp cert cache
  Fix unbounded cert cache growth in cmp
  Don't store ACK-only frames in TX history for QUIC.
  Add test for CVE-2026-63076
  Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

Approved by:    so
Obtained from:  OpenSSL

    [8 lines not shown]
DeltaFile
+338-0crypto/openssl/test/cmp_extracerts_dos_test.c
+16-75crypto/openssl/ssl/record/methods/dtls_meth.c
+66-10crypto/openssl/test/rpktest.c
+50-0crypto/openssl/test/cmp_vfy_test.c
+34-12crypto/openssl/ssl/quic/quic_txp.c
+28-12crypto/openssl/ssl/quic/quic_port.c
+532-10912 files not shown
+682-12518 files

FreeBSD/src 87bb4aasys/dev/hwpmc hwpmc_mod.c, sys/kern kern_exec.c

hwpmc: Fix the execve handler

When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs.  This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().

Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so.  It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug().  Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.

I think this check is trying to be too clever.  Let's make it simpler:
simply do not attach PMCs unless the owner is privileged.  This is how,
e.g., ktrace works.  I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.

    [11 lines not shown]
DeltaFile
+12-60sys/dev/hwpmc/hwpmc_mod.c
+1-1sys/kern/kern_exec.c
+13-612 files

LLVM/project e0560c4libcxx/test/std/numerics/c.math fpclassify.pass.cpp signbit.pass.cpp

[libc++][math][NFC] Generalize test-suite improvement for `signbit` and `fpclassify` tests (#217897)

This patch generalizes the test-suite improvements for
`signbit.pass.cpp` and `fpclassify.pass.cpp` as per the review comments
present in https://github.com/llvm/llvm-project/pull/210075 for
consistency purposes.

Follows-up:
https://github.com/llvm/llvm-project/pull/210075#discussion_r3629842324
DeltaFile
+29-36libcxx/test/std/numerics/c.math/signbit.pass.cpp
+11-19libcxx/test/std/numerics/c.math/fpclassify.pass.cpp
+40-552 files

FreeBSD/src 96bf349sys/sys ucred.h, tests/sys/mac/do Makefile regression.c

cred: Fix group_is_primary()

This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group.  If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.

group_is_primary() has exactly one use, in mac_do.  There, it's used to
determine whether the requested primary GID can be used in a setcred(2)
call when the ruleset does not explicitly specify a target primary GID.

I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).

Fix group_is_primary(), and add a regression test.


    [8 lines not shown]
DeltaFile
+83-0tests/sys/mac/do/regression.c
+1-1sys/sys/ucred.h
+2-0tests/sys/mac/do/Makefile
+86-13 files

FreeBSD/src fad7f65crypto/openssl/ssl/quic quic_port.c quic_txp.c, crypto/openssl/ssl/record/methods dtls_meth.c

openssl: Fix multiple vulnerabilities

This is a rollup commit from upstream to fix:
  Handle signature_algorithms_cert extension in key-only context
  Avoid double free of qrx in port_default_packet_handler()
  Avoid full read buffer allocation when buffering DTLS next-epoch records
  ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit
  ssl/record: remove dead DTLS processed_rcds record queue
  Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
  CMP unexpected sender DN used as format string in ERR_raise_data()
  Add test for CVE-2026-63073
  Add a test for restricting growth in cmp cert cache
  Fix unbounded cert cache growth in cmp
  Don't store ACK-only frames in TX history for QUIC.
  Add test for CVE-2026-63076
  Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

Approved by:    so
Obtained from:  OpenSSL

    [8 lines not shown]
DeltaFile
+338-0crypto/openssl/test/cmp_extracerts_dos_test.c
+16-75crypto/openssl/ssl/record/methods/dtls_meth.c
+66-10crypto/openssl/test/rpktest.c
+50-0crypto/openssl/test/cmp_vfy_test.c
+34-12crypto/openssl/ssl/quic/quic_txp.c
+28-12crypto/openssl/ssl/quic/quic_port.c
+532-10912 files not shown
+682-12518 files

FreeBSD/src 62c4afcsys/dev/sound/pcm channel.h dsp.c

dsp: Fix a potential use-after-free in dsp_oss_syncstart()

This function has a loop where it attempts to lock all channels in a
group.  If doing so would block, it releases all locks, sleeps for a
bit, and tries again.  However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again.  I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels.  Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Approved by:    so
Security:       FreeBSD-SA-26:58.sound
Security:       CVE-2026-58091
Reported by:    Hazley Samsudin of GovTech CSG
Reviewed by:    christos
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58912
DeltaFile
+6-11sys/dev/sound/pcm/dsp.c
+5-4sys/dev/sound/pcm/channel.h
+11-152 files