[docs] Enforce unambiguous toctree in clang/docs (#224101)
The rationale and methodology are the same as in
03511907c7a9908f7902e18d3789371a63bb91b1 just in `clang` this time.
[RISCV][P-Ext] Prefer pack/ppairo.h over pncvt.h/pncvth.h in shuffle lowering (#227105)
These have equivalent behavior, but pncvt.h/pncvth.h requires the input
to be a register pair. Shuffle lowering doesn't know if the sources came
from the same 64-bit value so using pncvt.h/pncvth.h may overconstrain
register allocation and require copies.
If some hardware has better performance for pncvt.h/pncvth.h we
can consider ways to intelligently pick the two alternatives. For
now just pick pack/ppairo.h.
ARM: Move abi name implied float abi to TargetParser (#226774)
ARMTargetMachine overrode the default float abi based on the abi name.
Move this logic to TargetParser so the ABI will be computable without
depending on codegen.
Co-authored-by: Claude Sonnet 5 <noreply at anthropic.com>
[OpenMP] Support up to 32 arguments in the generic microtask dispatcher (#211071)
Extend the generic `__kmp_invoke_microtask` implementation to support up
to 32 microtask arguments.
The generic dispatcher currently handles at most 15 arguments. OpenMP
regions with more captured variables terminate at runtime.
This affects WebAssembly because call_indirect requires the callee type
to exactly match the call-site type. Unlike assembly dispatchers on
platforms such as x86_64, the generic C++ implementation cannot
construct an arbitrary-arity call dynamically and must provide each
supported signature explicitly.
Real-world OpenMP regions can exceed the existing limit; the motivating
cases require between 16 and 21 arguments.
A longer-term alternative would be to change the compiler/runtime
convention for generic-dispatch targets so captured-variable pointers
are passed through a single packed context argument. That would remove
[3 lines not shown]
[lldb][Windows] Format in-process x86 and x64 GPRs as lowercase hex (#227299)
The in-process Windows plugin printed `x86`/`x64` registers in uppercase
hex, unlike every other register table.
`Test11588` compares against lowercase hex, so it only passed when the
address happened to have no letters.
This patch uses lowercase hex, matching `lldb-server`. Test11588 is
re-enabled.
TwoAddressInstructions: Add another reschedule copy order test (#227342)
Another test for the fix from #227289, which hit a different
assert condition.
Co-authored-by: Claude Opus 5 <noreply at anthropic.com>
[lldb][Windows] Register the shadow listener in PlatformWindows (#227277)
`PlatformWindows::DebugProcess` and `PlatformWindows::Attach` create the
Process and hijack its events, but never call
`Process::SetShadowListener` with the listener from the launch or attach
info. `PlatformPOSIX`, `PlatformRemoteGDBServer` and `Target::Launch`'s
all do.
On Windows a shadow listener set with `SBLaunchInfo::SetShadowListener`
therefore never gets an event, which is why
`TestEvents.test_shadow_listener` failed on every run (`"Shadow listener
got event too"`) on both the lldb-server and the in-process backend.
Call `SetShadowListener` in both, and in Attach only touch `process_sp`
once it is known to be non-null (HijackProcessEvents was called before
the null check).
I was able to reproduce the failure at desk on a machine that's under
load. The issue no longer reproduces after this patch.
[3 lines not shown]
[CodeGen] Remove DIE::setForceChildren and DIE::ForceChildren (NFC) (#227207)
The last caller of DIE::setForceChildren was removed on March 6, 2017
in commit a175512b18478848bdbe203f2d25dc417860e3c5, leaving
DIE::ForceChildren always false.
Assisted-by: Antigravity
[Clang] prevent instantiation of invalid friend function templates (#227038)
Fixes #226673
---
This patch addresses the issue in which an invalid friend function
template is instantiated as a valid declaration, leading to a crash upon
a later redeclaration.
---
This fixes a regression introduced by
https://github.com/llvm/llvm-project/pull/216555
openssl: Fix CVE-2026-84782
This is a backport of an upstream commit to fix:
dtls: reset init_off before retransmitting a message
Approved by: so
Security: FreeBSD-SA-26:68.openssl
Security: CVE-2026-84782
vfs: Disallow renameat() with FD_RESOLVE_BENEATH descriptors
The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR
262179 without entirely disallowing fd passing between jails. However,
one can use renameat() to bypass the restriction: upon receiving a
directory fd with FD_RESOLVE_BENEATH set, a jailed process can still
move its CWD or one of its ancestors to the directory, and just cd
out of its jail root.
So disallow renameat() when either the source or destination directory
fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot()
to prevent similar escapes.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101305
PR: 262179
Reported by: firk at cantconnect.ru
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59875
fdescfs: Pass up additional metadata during lookups
When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode. This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag. For
regular fdescfs mounts, this metadata is copied via dupfdopen().
Fix the problem by passing up this metadata through the nameidata
structure. Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n. Add some
regression tests as well.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101304
Reported by: Jan Bramkamp
Reviewed by: kib
[2 lines not shown]
file: Add a helper function to check whether filecaps are full
In a couple of places we want to know whether someone has limited rights
on an fd. There, we want a predicate which determines whether the set
of rights is smaller than CAP_ALL, and whether there are explicit ioctl
or fcntl lists. Factor this out into a helper function, in preparation
for use elsewhere.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59884
file: Add filecaps_intersect() and cap_rights_intersect()
These routines let one compute the intersection of two sets of filecaps
or capability rights, just as filecaps_merge() and cap_rights_merge()
compute the union. This will be useful in an upcoming patch.
filecaps_intersect() is complex due to the need to merge sets of ioctls.
For now this is implemented with a dumb nested loop on the basis that
ioctl lists are typically short enough that this is fine. It may be
better to instead sort the two lists first and step through them
together.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59885
sysvsem: Fix another sequence number wraparound race
semop() may sleep waiting for a semaphore. Upon waking up, it checks to
see if the set's sequence number has changed, indicating that the set
was removed. The sequence number is not wide enough to prevent a false
negative due to wraparound, in which case the subsequent access of
`semakptr->u.__sem_base[sopptr->sem_num]` may be out of bounds. This
race can be leveraged to elevate privileges.
Fix this by introducing a 64-bit sequence number for each semaphore
pool. This is wide enough to make the race impossible to hit. Allocate
a separate array for them, as we cannot really change the layout of
struct semid_kernel since some userspace tools (e.g., ipcrm(1)) embed
the layout.
While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to be bool, and use a better variable name to
store required permissions.
[8 lines not shown]
vfs: Disallow renameat() with FD_RESOLVE_BENEATH descriptors
The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR
262179 without entirely disallowing fd passing between jails. However,
one can use renameat() to bypass the restriction: upon receiving a
directory fd with FD_RESOLVE_BENEATH set, a jailed process can still
move its CWD or one of its ancestors to the directory, and just cd
out of its jail root.
So disallow renameat() when either the source or destination directory
fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot()
to prevent similar escapes.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101305
PR: 262179
Reported by: firk at cantconnect.ru
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59875
file: Add filecaps_intersect() and cap_rights_intersect()
These routines let one compute the intersection of two sets of filecaps
or capability rights, just as filecaps_merge() and cap_rights_merge()
compute the union. This will be useful in an upcoming patch.
filecaps_intersect() is complex due to the need to merge sets of ioctls.
For now this is implemented with a dumb nested loop on the basis that
ioctl lists are typically short enough that this is fine. It may be
better to instead sort the two lists first and step through them
together.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59885
sysvsem: Fix another sequence number wraparound race
semop() may sleep waiting for a semaphore. Upon waking up, it checks to
see if the set's sequence number has changed, indicating that the set
was removed. The sequence number is not wide enough to prevent a false
negative due to wraparound, in which case the subsequent access of
`semakptr->u.__sem_base[sopptr->sem_num]` may be out of bounds. This
race can be leveraged to elevate privileges.
Fix this by introducing a 64-bit sequence number for each semaphore
pool. This is wide enough to make the race impossible to hit. Allocate
a separate array for them, as we cannot really change the layout of
struct semid_kernel since some userspace tools (e.g., ipcrm(1)) embed
the layout.
While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to be bool, and use a better variable name to
store required permissions.
[8 lines not shown]
file: Add a helper function to check whether filecaps are full
In a couple of places we want to know whether someone has limited rights
on an fd. There, we want a predicate which determines whether the set
of rights is smaller than CAP_ALL, and whether there are explicit ioctl
or fcntl lists. Factor this out into a helper function, in preparation
for use elsewhere.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59884
kqueue: Fix a potential OOB access in kqueue_fork_copy_knote()
Here, fdp points to the new fdtable, copied from that of the parent
process. There is a window after the fdtable is copied, and before
kqueue_fork_copy_knote() runs, where a different thread in the parent
could have grown the parent's fdtable and registered a knote with ident
larger than the size of the child's fdtable. This race can lead to an
out-of-bounds read.
Add a bounds check for this case; skip the knote if it is referencing a
non-existent file.
Approved by: so
Security: FreeBSD-SA-26:65.kqueue
Security: CVE-2026-58100
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59916
kqueue: Fix handling of marker knotes during fork
Commit d8bdcb08d0eb fixed a problem in kqueue_fork_copy_knote() where we
did not skip over marker knotes when copying. However, that fix was not
sufficient: we bump the influx counter and check for a marker after
dropping the kqueue lock. So, if multiple threads in a process are
forking concurrently, kqueue_fork_copy_list() may mark a marker as
in-flux and drop the lock; if the marker owner then frees the marker,
the first thread will decrement the in-flux counter of a freed knotes.
This use-after-free can be exploited, at least prior to commit
d8bdcb08d0eb, which makes exploitation more challenging.
Approved by: so
Security: FreeBSD-SA-26:65.kqueue
Security: CVE-2026-58099
Reported by: Reo Shiseki
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59522
fdescfs: Pass up additional metadata during lookups
When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode. This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag. For
regular fdescfs mounts, this metadata is copied via dupfdopen().
Fix the problem by passing up this metadata through the nameidata
structure. Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n. Add some
regression tests as well.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101304
Reported by: Jan Bramkamp
Reviewed by: kib
[2 lines not shown]
openssl: Fix CVE-2026-84782
This is a commit from upstream to fix:
dtls: reset init_off before retransmitting a message
Approved by: so
Security: FreeBSD-SA-26:68.openssl
Security: CVE-2026-84782
[Clang][docs] Markup corrections for attribute documentation (#226729)
The conversion of Clang attribute documentation from reST to MyST
markdown did not transform markup correctly in all cases. Additionally,
some PRs that were originally authored for reST were merged after the
conversion resulting in reST formatted markdown getting re-introduced.
This change corrects all such cases the author was able to identify,
applies markup that was previously missing, corrects a few typos along
the way, and even adds a missing attribute documentation reference that
has prevented the `#pragma clang loop` `pipeline` and
`pipeline_initiation_interval` documentation from being published since
2019.
vfs: Disallow renameat() with FD_RESOLVE_BENEATH descriptors
The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR
262179 without entirely disallowing fd passing between jails. However,
one can use renameat() to bypass the restriction: upon receiving a
directory fd with FD_RESOLVE_BENEATH set, a jailed process can still
move its CWD or one of its ancestors to the directory, and just cd
out of its jail root.
So disallow renameat() when either the source or destination directory
fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot()
to prevent similar escapes.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101305
PR: 262179
Reported by: firk at cantconnect.ru
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59875
fdescfs: Pass up additional metadata during lookups
When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode. This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag. For
regular fdescfs mounts, this metadata is copied via dupfdopen().
Fix the problem by passing up this metadata through the nameidata
structure. Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n. Add some
regression tests as well.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101304
Reported by: Jan Bramkamp
Reviewed by: kib
[2 lines not shown]
openssl: Fix CVE-2026-84782
This is a commit from upstream to fix:
dtls: reset init_off before retransmitting a message
Approved by: so
Security: FreeBSD-SA-26:68.openssl
Security: CVE-2026-84782
