FreeBSD/src 269002d — sbin/fsck_msdosfs fat.c

fsck_msdosfs: fix head bitmap over-allocation on 32-bit platforms

bitmap_ctor() computed the allocation size as

        roundup2(bits, LONG_BIT) / (LONG_BIT / 8)

The dividend is a count of bits, so converting it to bytes requires
dividing by 8 (bits per byte), not by LONG_BIT / 8 (bytes per long).
The two divisors happen to coincide on LP64, but on ILP32 platforms
the head bitmap was allocated at twice the required size; for a
FAT32 file system with close to 2^28 clusters, that is 64 MiB instead
of 32 MiB.

The extra half of the allocation was never accessed, so there is no
functional change other than the reduced memory footprint.

MFC after:      3 days
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2440
DeltaFile
+1-1sbin/fsck_msdosfs/fat.c
+1-11 files

FreeBSD/src 10bd16d — sys/x86/cpufreq hwpstate_intel.c

ihwpstate_intel: update dev.hwpstate_intel.%d.epp sysctl description

Catch up with 8452afeb568: now dev.hwpstate_intel.%d.epp accepts
values from 0 to 255.  Update its description accordingly to sync
with the code and the man page.
DeltaFile
+1-1sys/x86/cpufreq/hwpstate_intel.c
+1-11 files

FreeBSD/src 27c6904 — . RELNOTES

Add release notes entry for less v710.

(cherry picked from commit 7f7e9584cb9dbff7f74faf5589c9154d2c6eef3f)
DeltaFile
+9-0RELNOTES
+9-01 files

FreeBSD/src e9c67d8 — . RELNOTES

MFC: Add release notes entry for less v710.

(cherry picked from commit 7f7e9584cb9dbff7f74faf5589c9154d2c6eef3f)
DeltaFile
+9-0RELNOTES
+9-01 files

FreeBSD/src c7bcccb — contrib/less lessmsg.inc lesskey.c

MFC: MFV: less v710.

(cherry picked from commit 4523eebc6c1828d4fd41d7f1ab943cf079043bc8)
DeltaFile
+342-280contrib/less/opttbl.c
+296-232contrib/less/screen.c
+246-129contrib/less/decode.c
+372-0contrib/less/lessmsg
+0-364contrib/less/lesskey.c
+331-0contrib/less/lessmsg.inc
+1,587-1,00552 files not shown
+3,285-1,81158 files

FreeBSD/src d3c6de9 — contrib/less lessmsg.inc lesskey.c

MFC: MFV: less v710.

(cherry picked from commit 4523eebc6c1828d4fd41d7f1ab943cf079043bc8)
DeltaFile
+342-280contrib/less/opttbl.c
+296-232contrib/less/screen.c
+246-129contrib/less/decode.c
+372-0contrib/less/lessmsg
+0-364contrib/less/lesskey.c
+331-0contrib/less/lessmsg.inc
+1,587-1,00552 files not shown
+3,285-1,81058 files

FreeBSD/src 6136e3d — contrib/expat Makefile.in, contrib/expat/lib internal.h xmltok.c

contrib/expat: import expat 2.8.5

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes

Security:       CVE-2026-93990

(cherry picked from commit c7b67985633c408cae69703ca443cbfd84d326a8)
DeltaFile
+349-5contrib/expat/tests/basic_tests.c
+100-123contrib/expat/lib/xmlparse.c
+139-64contrib/expat/lib/xmltok.c
+67-100contrib/expat/lib/internal.h
+105-56contrib/expat/Makefile.in
+157-0contrib/expat/tests/hash_tests.c
+917-34854 files not shown
+1,614-85960 files

FreeBSD/src 1dc191d — contrib/expat Makefile.in, contrib/expat/lib internal.h xmltok.c

contrib/expat: import expat 2.8.5

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes

Security:       CVE-2026-93990

(cherry picked from commit c7b67985633c408cae69703ca443cbfd84d326a8)
DeltaFile
+349-5contrib/expat/tests/basic_tests.c
+100-123contrib/expat/lib/xmlparse.c
+139-64contrib/expat/lib/xmltok.c
+67-100contrib/expat/lib/internal.h
+105-56contrib/expat/Makefile.in
+157-0contrib/expat/tests/hash_tests.c
+917-34854 files not shown
+1,614-85960 files

FreeBSD/src 4bfe526 — sys/dev/nvme nvme_ctrlr_cmd.c

nvme: share one routine between Delete I/O CQ and Delete I/O SQ

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60021
DeltaFile
+15-21sys/dev/nvme/nvme_ctrlr_cmd.c
+15-211 files

FreeBSD/src 8a860e8 — sys/dev/nvme nvme_sysctl.c

nvme: collapse the per-counter qpair statistic sysctl handlers

A single handler that takes the counter's offset
within struct nvme_qpair in arg2.

No functional change

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60020
DeltaFile
+20-98sys/dev/nvme/nvme_sysctl.c
+20-981 files

FreeBSD/src 130739e — sys/dev/nvmf/host nvmf_ns.c

nvmf: factor out the pending request abort loop

The routine is entered with the namespace lock held and drops it before
completing the requests, which preserves the existing locking.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60019
DeltaFile
+14-19sys/dev/nvmf/host/nvmf_ns.c
+14-191 files

FreeBSD/src 92dec92 — sys/dev/nvme nvme_sysctl.c

nvme: share one handler between the interrupt coalescing sysctls

The int_coal_time and int_coal_threshold handlers differed only in which
controller field they updated before reprogramming the feature.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60018
DeltaFile
+10-27sys/dev/nvme/nvme_sysctl.c
+10-271 files

FreeBSD/src 546d150 — sys/kern sysv_shm.c

sysvshm: Fix locking in shm_prison_set()

We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments.  Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.

Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60030
DeltaFile
+2-2sys/kern/sysv_shm.c
+2-21 files

FreeBSD/src 5e8678f — usr.sbin/zonectl zonectl.c

zonectl: Consistently report ZAC conv. zones WP LBA

On ZAC drives, conventional zones conventionally report a write pointer
LBA of 0xffffffffffff. This field is 48 bits wide, unlike ZBC's 64 bits.

Recognize both ZAC and ZBC all-ones behaviour in the WRITE POINTER LBA
field to indicate non-valid information.

Tested by:      fuz
Discussed with: fuz, asomers, ken
Fixes:          4735ef6196bc ("zonectl: display conventional zones better")
MFC after:      2 weeks
Sponsored by:   Google Summer Of Code 2026
Reviewed by:    asomers
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2345

(cherry picked from commit 95a4412e3a4d41b430f298ea2c2a51f8aa119c2c)
DeltaFile
+2-1usr.sbin/zonectl/zonectl.c
+2-11 files

FreeBSD/src de0aad8 — usr.bin/login login.conf

Increase the default mlock limit from 64k to 256k

The current default has been unchanged for 14 years.  Increase it to
keep pace with modern hardware and software.  security/pinentry-gnome,
in particular, can sometimes need 112 kB.

PR:             297452
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    cye, emaste
Differential Revision: https://reviews.freebsd.org/D58811

(cherry picked from commit d9cf2a8671841e4415a22e16005d7700f0eb9b7e)
DeltaFile
+1-1usr.bin/login/login.conf
+1-11 files

FreeBSD/src 1a6f201 — usr.sbin/zonectl zonectl.c

zonectl: display conventional zones better during RZ

zonectl's Report Zones subcommand displays a tabular list of zones.  A
conventional zone's WP column is displayed as 0xffffffffffffffff , the
literal value that the HDD reports.  But that's too wide for the column,
causing the text to be misaligned.  It's also not really meaningful,
because the Write Pointer isn't really defined for a Conventional zone.
Change it to "-1" to fix the text misalignment.

MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    fuz
Differential Revision: https://reviews.freebsd.org/D57512

(cherry picked from commit 4735ef6196bcb2802ad7fc7d1b8054a4756d786b)
DeltaFile
+14-3usr.sbin/zonectl/zonectl.c
+14-31 files

FreeBSD/src c5031d3 — sys/fs/fuse fuse_vnops.c fuse_io.c, tests/sys/fs/fusefs mockfs.cc utils.cc

fusefs: fix vnode locking violations during execve

Fix two locking violations that could happen during execve, while
executing a file stored on fusefs.  Both would cause panics on an
INVARIANTS kernel after 15.0, or a DEBUG_VFS_LOCKS kernel prior to that.
Neither is likely to be noticeable on a release kernel.

* Don't assume that the vnode is exclusively locked during VOP_CLOSE.
  It usually is thanks to !MNTK_LOOKUP_SHARED, but isn't during execve,
  which locks the vnode outside of the lookup path.

* Totally rewrite fuse_io_invalbuf.  It's had a number of problems ever
  since its original introduction[^1]:

  - Don't assume that the vnode is exclusively locked.  That assumption
    failed during execve just like the assumption in fuse_vnop_close.

  - Don't livelock forever if vinvalbuf returns ENOSPC or EDQUOT.


    [21 lines not shown]
DeltaFile
+304-0tests/sys/fs/fusefs/misc.cc
+55-0tests/sys/fs/fusefs/ext2-misc.sh
+2-47sys/fs/fuse/fuse_io.c
+22-5sys/fs/fuse/fuse_vnops.c
+2-1tests/sys/fs/fusefs/utils.cc
+1-1tests/sys/fs/fusefs/mockfs.cc
+386-542 files not shown
+388-568 files

FreeBSD/src 287d60a — sys/compat/linux linux_netlink.c

compat/linux: Fix IFLA_IFNAME translation for multi-message netlink

nlmsg_translate_ifname_nla() always used nw->ifp for the name,
which is fine for a single-message ifnet event, but an RTM_GETLINK
dump holds one RTM_NEWLINK per interface and is translated with
the ifp the writer had when the buffer was flushed.

The root of the problem is that msgs_to_linux() takes a single
ifp for a buffer that may contain messages about many interfaces.

Use ifi_index to resolve the name instead.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D59595
DeltaFile
+8-5sys/compat/linux/linux_netlink.c
+8-51 files

FreeBSD/src cb035c1 — sys/netpfil/ipfilter/netinet ip_lookup.c

ipfilter: fix inverted range check on the lookup iterator unit

ipf_lookup_iterate() validates iter.ili_unit with

  if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)

or alternatively,

  if (iter.ili_unit < -1 && iter.ili_unit > 7)

ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||

Submitted by calif.io for the OpenAI Patch The Planet program

Signed-off-by: Andrew Griffiths <andrew at calif.io>

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59726
DeltaFile
+1-1sys/netpfil/ipfilter/netinet/ip_lookup.c
+1-11 files

FreeBSD/src 0aa055e — sys/kern subr_asan.c

kasan: Fix the annotation for shadow map checks in atomic_load_*

atomic_load_* is a read, not a write.  Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1sys/kern/subr_asan.c
+1-11 files

FreeBSD/src 4523cbb — sys/sys imgact_aout.h

imgact_aout: Remove a prototype for a non-existent function

aout_coredump() was removed in commit 1eecfae3e53cb3.

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
DeltaFile
+0-8sys/sys/imgact_aout.h
+0-81 files

FreeBSD/src de6ee1f — sys/kern kern_jail.c

jail: Simplify refcount manipulation routines

- refcount_acquire() returns the old value, use that to assert that the
  old value was non-zero.
- refcount_release() already asserts that the refcount value is
  non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
  INVARIANTS and !INVARIANTS.

No functional change intended.

Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59983
DeltaFile
+11-26sys/kern/kern_jail.c
+11-261 files

FreeBSD/src d80c01b — sys/sys bio.h

geom: Remove unused fields from struct bio

The corresponding machinery was removed in commit 0c4440c3aafe6, ten
yearso ago.

No functional change intended.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59986
DeltaFile
+0-5sys/sys/bio.h
+0-51 files

FreeBSD/src 79af745 — sys/kern kern_jail.c

jail: Fix a race in prison_deref()

If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison.  However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.

Thus, defer the release of the prison refcount until after we've killed
all procs.

Reviewed by:    jamie
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59984
DeltaFile
+6-2sys/kern/kern_jail.c
+6-21 files

FreeBSD/src 5aac18d — usr.sbin/virtual_oss/virtual_oss main.c

virtual_oss(8): Fix cuse.ko check

There is no need at all to load the cuse module to just access the tool help.

kldload always checks for permissions first returning -EPERM if the user can't
load modules and -EEXIST if the user can, but the module is already loaded.

Approved by:            christos@
Differential Revision:  https://reviews.freebsd.org/D59844
MFC after:              2 weeks
DeltaFile
+5-2usr.sbin/virtual_oss/virtual_oss/main.c
+5-21 files

FreeBSD/src 75c0a83 — lib/libpfctl libpfctl.h libpfctl.c, sbin/pfctl parse.y pfctl_osfp.c

pf: convert DIOCOSFPFLUSH DIOCOSFPGET DIOCOSFPADD to netlink

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+149-0sys/netpfil/pf/pf_nl.c
+134-0lib/libpfctl/libpfctl.c
+21-0sys/netpfil/pf/pf_nl.h
+5-6sbin/pfctl/pfctl_osfp.c
+4-0lib/libpfctl/libpfctl.h
+1-1sbin/pfctl/parse.y
+314-71 files not shown
+315-87 files

FreeBSD/src 3c0846b — tests/sys/netpfil/pf Makefile osfp.sh

pf tests: basic osfp test

Load, list and clear the fingerprints.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+63-0tests/sys/netpfil/pf/osfp.sh
+1-0tests/sys/netpfil/pf/Makefile
+64-02 files

FreeBSD/src 219ce30 — lib/libpfctl libpfctl.h libpfctl.c, sbin/pfctl pfctl_table.c pfctl_radix.c

pf: convert DIOCRINADEFINE to netlink

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+94-0lib/libpfctl/libpfctl.c
+63-0sys/netpfil/pf/pf_nl.c
+0-29sbin/pfctl/pfctl_radix.c
+11-0sys/netpfil/pf/pf_nl.h
+2-2sbin/pfctl/pfctl_table.c
+3-0lib/libpfctl/libpfctl.h
+173-311 files not shown
+174-327 files

FreeBSD/src 754d2c6 — sys/conf NOTES

NOTES: Multiple schedulers can be compiled in at once

Mention that ULE is the default scheduler when multiple ones are
compiled in and how the tunable 'kern.sched.name' can be used to select
another one.

While here, regroup SCHED_ULE and SCHED_4BSD, as they control if the
respective scheduler instances are compiled in, putting SCHED_STATS
aside.

Reviewed by:    mchoo
Fixes:          75a66a92c92f ("- Add an option to compile in SCHED_STATS. ...")
Fixes:          1322760fd127 ("sys: enable both SCHED_ULE and SCHED_4BSD for some configs")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60014
DeltaFile
+10-7sys/conf/NOTES
+10-71 files

FreeBSD/src d972d83 — sys/conf NOTES, sys/x86/conf NOTES

NOTES: IPI_PREEMPTION: Fix documentation, applies to all architectures

Move its description into 'sys/conf/NOTES' and update it to match reality.

Reviewed by:    scheduler (mchoo)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60013
DeltaFile
+0-7sys/x86/conf/NOTES
+6-0sys/conf/NOTES
+6-72 files