HardenedBSD/src f75002fkrb5/lib/gssapi version.map, krb5/lib/krb5 version.map

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+1,744-0sys/arm64/include/hypervisor.h
+1,192-0krb5/lib/krb5/version.map
+405-0sys/arm64/vmm/vmm_reset.c
+172-155usr.sbin/syslogd/tests/syslogd_test.sh
+308-0krb5/lib/gssapi/version.map
+148-0krb5/plugins/kdb/db2/version.map
+3,969-155104 files not shown
+5,094-539110 files

HardenedBSD/ports e4644c2editors/vscode pkg-plist, net-im/tox Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+1,510-128editors/vscode/pkg-plist
+425-0sysutils/try-rs/distinfo
+211-0sysutils/try-rs/Makefile.crates
+14-20net-im/tox/Makefile
+19-0sysutils/try-rs/Makefile
+0-18net-im/tox/files/patch-toxcore_network.c
+2,179-16654 files not shown
+2,344-29460 files

HardenedBSD/src 24038d6sys/amd64/include pcb.h, sys/arm/include pcb.h

Revert "pcb.h: mark struct pcb to be preserved"

kgdb only uses the marked fields from dumppcb for initial frame
reconstruction.

This reverts commit 8f23665fed2fbaf4481359b4d2fcdd7b9feb40e3.
DeltaFile
+10-11sys/amd64/include/pcb.h
+8-9sys/i386/include/pcb.h
+0-5sys/arm64/include/pcb.h
+0-5sys/powerpc/include/pcb.h
+0-5sys/riscv/include/pcb.h
+0-4sys/arm/include/pcb.h
+18-396 files

HardenedBSD/src 8066b89sys/compat/linux linux_file.c, sys/kern vfs_mount.c

kern/vfs_unmount.c: promote flags to uint64_t

to prevent sign-extension, causing unexpected flags to be passed to
dounmount().  The mnt_flags and MNT_* constants are 64bit wide.

Suggested and reviewed by:      jah
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D55197
DeltaFile
+2-2sys/kern/vfs_mount.c
+1-1sys/compat/linux/linux_file.c
+1-1sys/sys/syscallsubr.h
+4-43 files

HardenedBSD/ports ed81283sysutils Makefile, sysutils/try-rs distinfo Makefile.crates

sysutils/try-rs: Add port

This is a cool tool (a reimagining of github.com/tobi/try) that creates,
searches, previews, and recalls all those little "what-if" terminal
experiments. Rather than deleting an experiment when you're done (guilty)
or putting all your experiments into one big directory with
incomprehensible names (guilty), it gives you a TUI to search, clone,
enter, edit, delete, etc. It can clone based on existing experiments, or
clone from git repos.

Perhaps most importantly, it comes with themes.
DeltaFile
+425-0sysutils/try-rs/distinfo
+211-0sysutils/try-rs/Makefile.crates
+19-0sysutils/try-rs/Makefile
+5-0sysutils/try-rs/pkg-descr
+1-0sysutils/Makefile
+661-05 files

HardenedBSD/src 997bfa2. RELNOTES

RELNOTES: Add some entries for recent commits

Reviewed by:    olce, jhb
Differential Revision:  https://reviews.freebsd.org/D55150
DeltaFile
+41-0RELNOTES
+41-01 files

HardenedBSD/src 2ca0b72sys/arm64/vmm vmm_mmu.c

arm64/vmm: Simplify vmmpmap_remove()

This function handles invalid intermediate PTP entries, but there's no
reason for this: the passed range should be mapped.  In particular, we
assert that all L3 entries encountered are mapped.  So let's simplify
the code a bit.  No functional change intended.

Reviewed by:    andrew
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54738

(cherry picked from commit 31e5decb18a6633f5137848b5734310b41fc3bdc)
DeltaFile
+6-21sys/arm64/vmm/vmm_mmu.c
+6-211 files

HardenedBSD/src c8dad68tests/sys/netpfil/pf divert-to.sh

pf tests: Set require.kmods in divert-to tests

Tests should declare their dependencies rather than testing for them at
runtime.

Reviewed by:    igoro, kp, glebius
MFC after:      2 weeks
Sponsored by:   OPNsense
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54846

(cherry picked from commit 8934c3dc780d6631cb23e4d98c7b988da9a5b703)
DeltaFile
+8-23tests/sys/netpfil/pf/divert-to.sh
+8-231 files

HardenedBSD/src 4775399sys/netpfil/pf pf.c

pf: Rationalize the ip_divert_ptr test

If a rule has a divert port set, then we can reasonably predict that
ipdivert.ko is loaded, and in particular that ip_divert_ptr is set.

Moreover, in this case, if ipdivert.ko is not loaded we should just drop
the packet instead of ignoring the divert rule.

Reviewed by:    igoro, kp, glebius
MFC after:      2 weeks
Sponsored by:   OPNsense
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54845

(cherry picked from commit 39878d24a690feb4da3fc223649c6a5fd166d09d)
DeltaFile
+10-5sys/netpfil/pf/pf.c
+10-51 files

HardenedBSD/src 6e7cf7fusr.sbin/syslogd/tests syslogd_test_common.sh syslogd_test.sh

syslogd/tests: Improve loopback interface initialization

- In syslogd_start(), assign the lo0 address in the specified jail.
- Use the correct netmask.

Reviewed by:    jlduran
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54799

(cherry picked from commit 92d251472edba6c1c16a899797982251c585d706)
DeltaFile
+5-3usr.sbin/syslogd/tests/syslogd_test_common.sh
+0-4usr.sbin/syslogd/tests/syslogd_test.sh
+5-72 files

HardenedBSD/src fbc5610usr.sbin/makefs/tests makefs_zfs_tests.sh

makefs/zfs/tests: Force-destroy md devices

Most of these tests create a md(4) device backed by a makefs-generated
image, then import the pool, using the md device as a pool vdev.  When
a test finishes, it destroys the pool, then destroys the md device.

Once in a while md device destruction fails with EBUSY.  This happens
when a GEOM consumer is holding the device open; kern_mddetach_locked()
simply fails if any consumers are present.  zpool destruction is
synchronous so ZFS is innocent, rather, the problem seems to be that
GEOM re-tastes the device after the zpool reference goes away.  This
operation creates a transient reference that causes the spurious
failure.

Use "mdconfig -o force" to work around this.

MFC after:      2 weeks

(cherry picked from commit d6bc31f92991b6d67da54868f3563278015389ca)
DeltaFile
+2-2usr.sbin/makefs/tests/makefs_zfs_tests.sh
+2-21 files

HardenedBSD/src 10b4ff3sys/netinet6 ip6_mroute.c

ip6_mroute: Remove unnecessary casts

No functional change intended.

MFC after:      1 week
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.

(cherry picked from commit 56e1cba88bb82f2a6af0212c72182ff6303a1554)
DeltaFile
+3-4sys/netinet6/ip6_mroute.c
+3-41 files

HardenedBSD/src 0e67516usr.sbin/syslogd/tests syslogd_test_common.sh syslogd_test.sh

syslogd/tests: Fix flakiness in forwarding tests

syslogd_start() waits for the local log socket to appear before
returning, to ensure that the daemon is ready to handle log messages.
Some tests start two daemons, so by default the socket already exists
when the second daemon is started, so syslogd_start() returns early.
The test subsequently sends a message to this second daemon, which
sometimes isn't ready.

Define a separate log socket for the second daemon.  Add a check to
syslogd_start() to help catch this type of bug.

Reviewed by:    jlduran
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54800

(cherry picked from commit 14dce731d70686e08ed689729f53c6a5e2225498)
DeltaFile
+7-2usr.sbin/syslogd/tests/syslogd_test_common.sh
+5-3usr.sbin/syslogd/tests/syslogd_test.sh
+12-52 files

HardenedBSD/src 7855f83tests/sys/netinet6 test_ip6_output.py

ip6_output tests: Remove an unused import

No functional change intended.

MFC after:      1 week
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.

(cherry picked from commit 1539a657adb4363e7f12d6fd4c1c8ed2e2d842af)
DeltaFile
+0-1tests/sys/netinet6/test_ip6_output.py
+0-11 files

HardenedBSD/src b4036aeusr.sbin/syslogd/tests syslogd_test.sh syslogd_forwarded_format_test.sh

syslogd/tests: Address races

I occasionally see failures in the syslogd test suite.  The problem is
that the tests are racy: they send a message using logger(1), then
immediately check whether the message was logged to a log file.  If the
syslogd instance under test doesn't get a chance to run before the
second step, the test fails.

This change reworks things to avoid the race while minimizing the amount
of time sleeping.
1) Each test uses a single logfile, so have them use a new common
   variable, SYSLOGD_LOGFILE, instead of something test-specific.
2) In syslogd_start(), if the configuration references SYSLOGD_LOGFILE,
   wait for it to be created by syslogd before returning.
3) Add a helper syslogd_check_log(), to check for a given log entry in
   the last line of SYSLOGD_LOGFILE, instead of using atf_check
   directly.
4) In syslogd_check_log(), poll the logfile until the desired log entry
   appears, or the test times out.

    [10 lines not shown]
DeltaFile
+112-129usr.sbin/syslogd/tests/syslogd_test.sh
+16-26usr.sbin/syslogd/tests/syslogd_forwarded_format_test.sh
+33-0usr.sbin/syslogd/tests/syslogd_test_common.sh
+12-18usr.sbin/syslogd/tests/syslogd_relayed_format_test.sh
+11-17usr.sbin/syslogd/tests/syslogd_basic_format_test.sh
+0-1usr.sbin/syslogd/tests/syslogd_format_test_common.sh
+184-1916 files

HardenedBSD/src 9e92175tests/atf_python atf_pytest.py

atf_python: Fix a typo in a type annotation

No functional change intended.

MFC after:      1 week
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.

(cherry picked from commit ef389b7f581b2500c0e18c0989a54465712cd175)
DeltaFile
+1-1tests/atf_python/atf_pytest.py
+1-11 files

HardenedBSD/src c55fcf3usr.sbin/syslogd/tests syslogd_test.sh syslogd_test_common.sh

syslogd/tests: Use a helper function to log from within a jail

This is just for consistency with all other logger(1) invocations, which
happen from the syslogd_log() function.

No functional change intended.

Reviewed by:    jlduran
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54778

(cherry picked from commit ffdbc1bc2170226547fcad036f01f379625886dd)
DeltaFile
+31-29usr.sbin/syslogd/tests/syslogd_test.sh
+7-0usr.sbin/syslogd/tests/syslogd_test_common.sh
+38-292 files

HardenedBSD/src eefbbefusr.sbin/syslogd syslogd.c, usr.sbin/syslogd/tests syslogd_test.sh

syslogd: Terminate pipe processes gracefully

Pipe actions spawn a process based on the command provided in the
syslogd configuration file. When a HUP signal is received, enter
the process into the deadq instead of immediately killing it.
This matches the behavior of syslogd prior to it being Capsicumized.

Fixes: d2d180fb7736

(cherry picked from commit 60ae4e52f33e3c67720b68a29e35f6c114a3386c)
DeltaFile
+36-58usr.sbin/syslogd/syslogd.c
+34-0usr.sbin/syslogd/tests/syslogd_test.sh
+70-582 files

HardenedBSD/src 9f80816sys/netinet ip_mroute.c

ip_mroute: EVENTHANDLER_REGISTER does not fail

No functional change intended.

MFC after:      1 week
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.

(cherry picked from commit 0f1e1350704af555a4b30136f5f3d16db6f2dc51)
DeltaFile
+0-6sys/netinet/ip_mroute.c
+0-61 files

HardenedBSD/src d17e192contrib/netbsd-tests/lib/libc/regex t_exhaust.c

netbsd-tests: Fix regcomp_too_big flakiness

The test sometimes crashes with ASLR enabled.  This seems to happen when
regcomp() grows the process stack and happens to run into the virtual
memory limit set at the beginning of the test.  ASLR triggers the
problem since it introduces a bit of fragmentation and thus introduces
cases where stack allocation can be the trigger of virtual memory
exhaustion, rather than dynamic memory allocation in regcomp().

Make the test stable by priming the stack before doing anything else.
This effectively reserves 16MB of virtual memory for the stack, which in
practice is enough to make the test stable on amd64.

PR:             259971
Reviewed by:    ngie, emaste
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54880

(cherry picked from commit 938915a22c84af88afa587694e8d63ce9dd202f4)
DeltaFile
+14-3contrib/netbsd-tests/lib/libc/regex/t_exhaust.c
+14-31 files

HardenedBSD/src 71dd4e0sys/amd64/include md_var.h, sys/amd64/vmm vmm_host.h

amd64: Fix sys/pcpu.h usage in vmm_host.h and md_var.h

Include sys/pcpu in vmm_host.h as its structs and functions are used
there, and add a forward declaration of struct pcpu to md_var.h as it
is used in some function prototypes.

Reviewed by:    corvink, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D51550

(cherry picked from commit 202e3109a9d6699cf78e83f9047cefeb07659767)
DeltaFile
+2-0sys/amd64/vmm/vmm_host.h
+1-0sys/amd64/include/md_var.h
+3-02 files

HardenedBSD/src 389762alib/libsys kqueue.2

kqueue.2: Fix reference to unexisting kevent1()

kqueue1() was meant.

While here, make the wording in the AUTHORS section more clear.

PR:             291908
Fixes:          9b1585384d53 ("kqueue.2: Editorial pass")
Reviewed by:    kib, dab
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54858

(cherry picked from commit 4efe75af0869dd71a26685c432e5284d71bf4dc8)
DeltaFile
+4-4lib/libsys/kqueue.2
+4-41 files

HardenedBSD/src 97ce8f7sys/amd64/amd64 machdep.c exec_machdep.c, sys/amd64/include param.h

amd64: define and use STACKALIGN and REDZONE_SZ

Reviewed by:    brooks, emaste, jhb
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D55151
DeltaFile
+3-3sys/amd64/amd64/machdep.c
+2-2sys/amd64/amd64/exec_machdep.c
+2-2sys/amd64/amd64/mp_machdep.c
+3-0sys/amd64/include/param.h
+10-74 files

HardenedBSD/ports 7a82900devel/sasm distinfo Makefile

devel/sasm: Update 3.15.0 => 3.16.0

Changelog:
https://github.com/Dman95/SASM/releases/tag/v3.16.0

PR:     293062
DeltaFile
+3-3devel/sasm/distinfo
+1-1devel/sasm/Makefile
+4-42 files

HardenedBSD/src 30988d0sys/net if_lagg.c

lagg: Make lagg_link_active() static

It is declared as static. Make the definition consistent with the
declaration.

It was ever fixed by commit 52e53e2de0ec, but the commit was reverted,
leaving it unfixed.

No functional change intended.

MFC after:      3 days
DeltaFile
+1-1sys/net/if_lagg.c
+1-11 files

HardenedBSD/src 1c41e41sys/arm64/arm64 identcpu.c, sys/arm64/include cpu.h

arm64: Have get_kernel_reg return void

It now panics when it's unable to find the register, so doesn't need
to return a status.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55106
DeltaFile
+4-4sys/arm64/arm64/identcpu.c
+2-2sys/arm64/include/cpu.h
+6-62 files

HardenedBSD/src a8c3933sys/arm/arm generic_timer.c, sys/arm64/arm64 pmap.c ptrauth.c

arm64: Assume get_kernel_reg returns true

It now only returns true so this can be assumed and doesn't need to be
checked.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55105
DeltaFile
+17-22sys/arm64/vmm/vmm_arm64.c
+9-12sys/arm64/arm64/pmap.c
+6-9sys/arm64/arm64/ptrauth.c
+3-4sys/dev/hwpmc/hwpmc_arm64.c
+3-4sys/arm/arm/generic_timer.c
+3-4sys/libkern/gsb_crc32.c
+41-555 files not shown
+49-7211 files

HardenedBSD/src 3b0b6aasys/arm64/arm64 identcpu.c

arm64: Panic if the ID register isn't known

This will allow for callers to be simplified & not need to check the
return status.

Keep the return type for now so this can be MFCd without breaking the
KBI.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55104
DeltaFile
+2-2sys/arm64/arm64/identcpu.c
+2-21 files

HardenedBSD/src 0ea31fesys/arm64/arm64 identcpu.c

arm64: Move creating the ID register views earlier

These are needed when enabling CPU features so should be processed
earlier in the boot.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55103
DeltaFile
+26-13sys/arm64/arm64/identcpu.c
+26-131 files

HardenedBSD/ports 7f4afbdnet/libpfctl Makefile distinfo

net/libpfctl: add 14.4 version

PR:             293048
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+1-1net/libpfctl/Makefile
+2-0net/libpfctl/distinfo
+3-12 files