security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
PR: 296874
Security: CVE-2026-11771
Security: CVE-2026-12932
Security: CVE-2026-12996
[9 lines not shown]
ietp: guard iicbus_get_addr with devclass check
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58432
security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
PR: 296874
Security: CVE-2026-11771
Security: CVE-2026-12932
Security: CVE-2026-12996
[7 lines not shown]
[lldb] Fix heap-use-after-free in FileSpec usage (#211908)
After #211394, `FileSpec` stores m_filename as a `SmallString` instead
of `ConstString`. When the `FileSpec` goes out of scope / is destructed,
a `StringRef` pointing to m_filename is now invalid. Previously it would
have worked even after `FileSpec` goes out of scope since `ConstString`
stores the string in a global buffer which is never destructed.
This causes heap-use-after-free in `CommandInterpreter` when we use the
result of `GetFilename()` on a temporary `FileSpec`. Store the result of
`HostInfo::GetProgramFileSpec()` as a variable to prevent it from going
out of scope before we're able to call `GetHomeInitFile()`.
Although #211394 introduces this failure, technically speaking this is
an existing bug, it was just masked because of how `FileSpec` used to
use `ConstString` to force a long lifetime.
[LoopInfo] Store blocks using Euler tour representation (#211485)
Block list construction appends each block to all enclosing loops
(O(depth) per block), and each loop owns a separately allocated vector.
Switch to an Euler tour representation: one BlockLayout array per
LoopInfo holding the in-loop blocks in a loop-contiguous reverse
postorder, each loop's list a [begin, end) slice of it, subloop slices
nested inside their parent's. Headers remain first;
`SubLoops`/`TopLevelLoops` orders are unchanged. A few tests observe the
order and are updated. (Previously a loop's list was the function's
reverse postorder restricted to its members, so a subloop's blocks were
interleaved with the parent's own blocks at their RPO positions.)
Mutations first copy a borrowed slice into private storage from
LoopInfo's allocator. `contains(BlockT *)` remains map-based: a
materialized loop's slice is not a membership test. This copy is rare:
across default<O2> over dagcombiner and sqlite3, only 12--14% of loops
built by analyze() are ever mutated; the rest keep the borrowed slice.
[4 lines not shown]
xhci: Refactor xhci_generic_setup code
Our USB TRB buildup subroutines were previously difficult to follow. In
setup_generic_chain_sub(), the routine filled TRB packets based on the
characteristics passed by the caller and the current state (for example,
whether the TRB was the last in the TD).
However, most TRB types (except Normal TRBs) cannot be shared across TDs.
To simplify the logic, refactor xhci_setup_generic() so that TRBs are
constructed according to their transfer type, with dedicated helper
functions for each TRB type.
Sponsored by: The FreeBSD Foundation
Assisted-by: Claude Code (Opus 4.6, Opus 4.8(1M) and Sonet 5.0)
Differential Revision: https://reviews.freebsd.org/D57130
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
[flang][cuda] Accept statement function in device code (#211957)
Statement functions are inlined during lowering, so they should not be
treated as host procedure calls. Recursively validate their expressions
to reject any host procedure calls within the body.
