bsd.crunchgen.mk: Add CRUNCH_HOSTPROGS_${P} and fix awk in rescue
The usr.bin/awk consists of two subdirs: (1) 'awk' the actual program;
(2) 'maketab' a host program to help generate additional source.
Previously, the initrd/rescue/Makefile pointed the awk source to
'usr.bin/awk', and that caused the following warning:
```
crunchgen: rescue.conf: awk: warning: could not find any .o files
```
And pointing the source to 'usr.bin/awk/awk' couldn't fix it because the
required 'maketab' program would be unavailable.
To fix the problem as well as to extend the crunchgen framework, add the
CRUNCH_HOSTPROGS_${P} variable to specify the host programs required by
the build. Implement the rules and specify the dependencies to build
the host programs.
[2 lines not shown]
initrd: Merge rescue.libcrypto into rescue
After the last commit fixed the 'crc32' symbol conflict between
libhammer and libz, the merge of rescue.libcrypto and rescue only had
one conflict symbol: tilde_expand() from libprivate_ssh and
libprivate_edit. Work around this symbol conflict by setting
libprivate_ssh an internal library for ssh/scp.
This merge reduces the rescue binaries size by ~1.1MB, from 12.1MB
(rescue 5.3MB + rescue.libcrypto 6.8MB) to 11MB.
libhammer(3): Exclude crc32.c and icrc32.c from sys/libkern
The user hammer(8) already includes these sources from sys/libkern, so
don't need to provide them in this library. More importantly, this
avoids the 'crc32' symbol conflict with libz.
crunchgen(1): Improve the handling of internal libraries
Previously, the `libs_int` and `special lib_int` commands specified the
internal libraries by their full paths, following the way of handling of
the shared libraries by `libs_so` and `special lib_so`. However, this
was actually a mistake because the internal libraries require building.
So it was lucky/hacky that rescue/rescue.libcrypto specified the
internal libraries with a combination of source directory and the
library name, e.g.,
```
CRUNCH_INTLIB_grep= ${CRUNCH_PATH_grep}/grep/libgreputils/libgreputils.a
CRUNCH_INTLIB_telnet= ${.CURDIR}/../../lib/libtelnet/libtelnet.a
```
To actually properly support internal libraries, we must explicitly the
source directories, as well as support build options. To this end,
change the `libs_int` and `special lib_int` commands to only specify the
libraries names, and then extend the `special srcdir` to explicitly the
[10 lines not shown]
bsd.crunchgen.mk: Add CRUNCH_HOSTPROGS_${P} and fix awk in rescue
The usr.bin/awk consists of two subdirs: (1) 'awk' the actual program;
(2) 'maketab' a host program to help generate additional source.
Previously, the initrd/rescue/Makefile pointed the awk source to
'usr.bin/awk', and that caused the following warning:
```
crunchgen: rescue.conf: awk: warning: could not find any .o files
```
And pointing the source to 'usr.bin/awk/awk' couldn't fix it because the
required 'maketab' program would be unavailable.
To fix the problem as well as to extend the crunchgen framework, add the
CRUNCH_HOSTPROGS_${P} variable to specify the host programs required by
the build. Implement the rules and specify the dependencies to build
the host programs.
[2 lines not shown]
crunchgen(1): Remove the unneeded '-dc' linker flag
crunchide(1) does not hide symbols by making them local for many years.
We've also been using '-fno-common' compiler flag for a long time. So
the '-dc' linker flag is obsolete. Just remove it.
Obtained-from: FreeBSD (https://reviews.freebsd.org/D34215)
crunchgen(1): Enhance the '-q' (quiet) option to control warnings
Only suppress the warning messages about the component program when the
'-q' option is specified twice.
For example, now the following suppressed warning in crunching
initrd/rescue is shown:
```
crunchgen: rescue.conf: awk: warning: could not find any .o files
```
This also reveals a real problem in the 'awk' component, and I've
created a bug to track it:
https://bugs.dragonflybsd.org/issues/3414
crunchgen(1): Update usage() text and sort options
* Add the missing '-l' option to the usage text.
* Sort the options in the usage text and in the man page.
atomic(9): Add relaxed load/store variants from FreeBSD
Obtained from FreeBSD. However, the original atomic_store_ptr() macro
was causing '-Wcast-qual' warnings, so I changed it based on the
NetBSD's atomic_store_relaxed().
Actually, I found NetBSD's version more clean, but we import the FreeBSD
version to help import code/drivers in the future.
Discussed-with: dillon
hammer2: Disable debug v/f-chain dumps on unmounting
The two dumps were added to track down the HAMMER2-msg leak reported by
malloc_uninit() and would always print the following logs at shutdown:
```
v-chain 0xfffff8008e6204c0 volume.0 00000000000000100000000000000000/0 mir=00000000000
00140
[00002000] (?) refs=1
f-chain 0xfffff8008e620640 freemap.0 00000000000000100000000000000000/0 mir=0000000000
000140
[00002000] (?) refs=1
```
Given that the memory leak has been fixed in commit
bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
now.
ok by dillon.
hammer2: Disable debug v/f-chain dumps on unmounting
The two dumps were added to track down the HAMMER2-msg leak reported by
malloc_uninit() and would always print the following logs at shutdown:
```
v-chain 0xfffff8008e6204c0 volume.0 00000000000000100000000000000000/0 mir=00000000000
00140
[00002000] (?) refs=1
f-chain 0xfffff8008e620640 freemap.0 00000000000000100000000000000000/0 mir=0000000000
000140
[00002000] (?) refs=1
```
Given that the memory leak has been fixed in commit
bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
now.
ok by dillon.
kern: Fix memory leak in kdmsg_iocom_uninit()
When kdmsg_iocom_uninit() is called but no connection was ever
established (no reader/writer threads), a PING message was allocated and
queued but never freed. This caused a 120-byte leak from the HAMMER2-msg
allocator on shutdown.
Fix this by calling kdmsg_drain_msgq() to clean up any queued messages.
This fixes the 'malloc_uninit: 120 bytes of HAMMER2-msg still allocated'
warning. Note that this warning already disappeared after fixing the
hammer2_ioctl_recluster() bug in commit
c5cc81fefa166cc45657541c155797f0cff88c62.
Bug: https://bugs.dragonflybsd.org/issues/3385
kern: Clean up malloc_uninit()
* Correct the diagnostic log message by omitting the CPU id, which
doesn't apply here. The unfreed bytes must be summed from all CPUs.
* Clean up excess INVARIANTS ifdef's by using '__debugvar' instead.
mpc: Fix inclusion paths to correctly include its own 'config.h'
It wrongly included the GMP's 'config.h', as the '../gmp/' directory has
both 'gmp.h' and 'config.h'.
kernel: Fix two bugs in gptinit()
* Fix the wrong type for 'table_lba'; should be 'uint64_t' instead of
'uint32_t', and fix the read to use le64toh().
* Allow the partition table has entries more than 128 (MAX_GPT_ENTRIES).
The UEFI specification basically has no upper limit, but we limit to
parsing the first 128 (MAX_GPT_ENTRIES) entries.
This actually happens with a Proxmox v9.2 ISO, which uses GPT and
allocates 44 blocks for the partition table, so there are 176 entries.
For example, here is the gpt(8) of a USB stick written with this ISO:
```
Disk da8: 57.3GB (120225792 512-byte sectors)
Start Sectors Size Index Contents
0 1 512B - PMBR
1 1 512B - Primary GPT header
[13 lines not shown]
mincore(2): Add 'vm.mincore_mapped' sysctl to control reporting
Add the 'vm.mincore_mapped' (default ON!) to control whether to report
only the mapping status (if set to a non-zero value) or the physical
residency (if set to a zero value; the old behavior).
The idea of implementing this and enabling it by default is to help
mitigate page cache attacks [1].
[1] Page Cache Attacks: https://arxiv.org/abs/1901.01161
Obtain-from: FreeBSD (https://reviews.freebsd.org/D18764)
mincore(2): Fix several bugs
* Return ENOMEN when the requested range is not fully mapped.
(obtained from FreeBSD: 455dd7d4c79bc7bef5401721f617e64eca7ef422)
This change should fix a crash in Mesa where it calls mincore() to
determine whether a protocol field is a valid pointer in order to
keep compatible with an old protocol version.
* Fix an off-by-one error in filling the skipped entries. lastvecindex
refers to the last valid byte, so the new bytes should come after it.
(obtained from FreeBSD: 6a87d217e2da2a63d4431aeb871783e1dd7349ae)
* Fix the calculation of the 'end' boundary.
(obtained from FreeBSD: d0c9294b810f8b42b7ac27a46db44b94ddca3160)
* Update the man page.
Reported-by: peeterm
jail: Fix potential buffer overflow in sysctl_jail_list()
sysctl_jail_list() allocates a buffer of size = count*1024, and then
uses ksnprintf() to format the jail information and advance the write
position. However, ksnprintf() returns the would-be length (i.e., the
number of bytes would be written if the buffer is big enough). So a jail
that has a very long path and/or many IPs would overflow the allocated
buffer.
Fix the bug by correctly handling the return value of ksnprintf().
GitHub-PR: #45
Reported-by: Nathan Sapwell (jewbird)
vm: Remove duplicate reference in cdev_pager_allocate()
The code was updated in 2013 [1] to bring in various changes from
FreeBSD, but left this duplicate reference. Remove the erroneous
vm_object_reference_locked() call.
[1] kernel: Port new device_pager interface from FreeBSD
commit f2c2051ee473577d22178d55f782ceebbd88d58f
GitHub-PR: #49
Credit: LI Leding
rpcinfo(8): Fix stack buffer overflow in rpcbdump()
The function previously used unbounded sprintf() and strcat() to format
the info into a fixed 256-byte stack buffer. A malicious or compromised
rpcbind endpoint that returns enough distinct version numbers for a
single program (roughly 24 maximum-width decimal values plus separators)
can overflow this buffer.
CVE: CVE-2026-16461
Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
(https://www.openwall.com/lists/oss-security/2026/07/23/8)
