HardenedBSD/src 97737f9contrib/mtree create.c mtree.8, contrib/netbsd-tests/usr.sbin/mtree t_mtree.sh

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+60-84contrib/mtree/create.c
+108-31contrib/mtree/mtree.8
+37-9contrib/mtree/spec.c
+25-16contrib/mtree/compare.c
+39-1contrib/netbsd-tests/usr.sbin/mtree/t_mtree.sh
+10-10contrib/mtree/crc.c
+279-1515 files not shown
+312-17011 files

HardenedBSD/src 1e1ad0econtrib/mtree create.c mtree.8, contrib/netbsd-tests/usr.sbin/mtree t_mtree.sh

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+60-84contrib/mtree/create.c
+108-31contrib/mtree/mtree.8
+37-9contrib/mtree/spec.c
+25-16contrib/mtree/compare.c
+39-1contrib/netbsd-tests/usr.sbin/mtree/t_mtree.sh
+10-10contrib/mtree/crc.c
+279-1515 files not shown
+312-17011 files

HardenedBSD/src 7cc0266contrib/netbsd-tests/usr.sbin/mtree t_mtree.sh

mtree: tests: Import NetBSD's mtree test suite

Manually import latest mtree test suite from NetBSD.

MFC after:      1 week

(cherry picked from commit 2f29d0f3e6d25599c188c94bf1e395d9cbeb2a4d)
DeltaFile
+39-1contrib/netbsd-tests/usr.sbin/mtree/t_mtree.sh
+39-11 files

HardenedBSD/src 12aa5ffcontrib/mtree compare.c spec.c

mtree: Fix typos

Manually apply a typo fix.  This change has already been submitted
upstream as bin/59824.

MFC after:      1 week

(cherry picked from commit dab5daf54cc26aaf2679a2eda5f378461f279ec5)
DeltaFile
+1-1contrib/mtree/compare.c
+1-1contrib/mtree/spec.c
+2-22 files

HardenedBSD/src ecc2e2econtrib/mtree create.c mtree.8

Import latest mtree from NetBSD

Merge commit 'f600477feb4ae61a75f61949eb600caff4aeea8c'

MFC after:      1 week
Discussed with: brooks

(cherry picked from commit 49b6dda4d71175ad615718401573be5fd024822b)
DeltaFile
+60-84contrib/mtree/create.c
+108-31contrib/mtree/mtree.8
+36-8contrib/mtree/spec.c
+24-15contrib/mtree/compare.c
+10-10contrib/mtree/crc.c
+12-5contrib/mtree/verify.c
+250-1534 files not shown
+271-16710 files

HardenedBSD/src 9bbfffecontrib/netbsd-tests/usr.sbin/mtree t_mtree.sh

mtree: tests: Import NetBSD's mtree test suite

Manually import latest mtree test suite from NetBSD.

MFC after:      1 week

(cherry picked from commit 2f29d0f3e6d25599c188c94bf1e395d9cbeb2a4d)
DeltaFile
+39-1contrib/netbsd-tests/usr.sbin/mtree/t_mtree.sh
+39-11 files

HardenedBSD/src 97984decontrib/mtree compare.c spec.c

mtree: Fix typos

Manually apply a typo fix.  This change has already been submitted
upstream as bin/59824.

MFC after:      1 week

(cherry picked from commit dab5daf54cc26aaf2679a2eda5f378461f279ec5)
DeltaFile
+1-1contrib/mtree/compare.c
+1-1contrib/mtree/spec.c
+2-22 files

HardenedBSD/src f6fb1f8contrib/mtree create.c mtree.8

Import latest mtree from NetBSD

Merge commit 'f600477feb4ae61a75f61949eb600caff4aeea8c'

MFC after:      1 week
Discussed with: brooks

(cherry picked from commit 49b6dda4d71175ad615718401573be5fd024822b)
DeltaFile
+60-84contrib/mtree/create.c
+108-31contrib/mtree/mtree.8
+36-8contrib/mtree/spec.c
+24-15contrib/mtree/compare.c
+10-10contrib/mtree/crc.c
+12-5contrib/mtree/verify.c
+250-1534 files not shown
+271-16710 files

HardenedBSD/src c4d5a99sys/contrib/openzfs/contrib/initramfs/scripts zfs, sys/contrib/openzfs/module/os/linux/zfs zfs_ctldir.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+364-299sys/contrib/openzfs/contrib/initramfs/scripts/zfs
+103-66sys/contrib/openzfs/module/zfs/ddt.c
+104-38sys/contrib/openzfs/module/os/linux/zfs/zfs_ctldir.c
+71-42sys/contrib/openzfs/module/zfs/dsl_scan.c
+53-40sys/contrib/openzfs/module/zfs/arc.c
+86-0sys/contrib/openzfs/tests/zfs-tests/tests/functional/dedup/dedup_prune_leak.ksh
+781-48565 files not shown
+1,420-76971 files

HardenedBSD/src 1f7bbf9sys/contrib/openzfs/contrib/initramfs/scripts zfs, sys/contrib/openzfs/module/os/linux/zfs zfs_ctldir.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+364-299sys/contrib/openzfs/contrib/initramfs/scripts/zfs
+103-66sys/contrib/openzfs/module/zfs/ddt.c
+104-38sys/contrib/openzfs/module/os/linux/zfs/zfs_ctldir.c
+71-42sys/contrib/openzfs/module/zfs/dsl_scan.c
+53-40sys/contrib/openzfs/module/zfs/arc.c
+86-0sys/contrib/openzfs/tests/zfs-tests/tests/functional/dedup/dedup_prune_leak.ksh
+781-48565 files not shown
+1,420-76971 files

HardenedBSD/src 7f39d05sbin/reboot reboot.c

reboot: Fix halt -p behavior

The RB_HALT bit is always set when invoked as `halt`, so to maintain a
distinction between `halt` and `halt -p`, we must check the RB_POWEROFF
bit first.

PR:             291814
Fixes:          4453ec5b8716 ("reboot: Default to a clean shutdown")
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D54320
DeltaFile
+2-2sbin/reboot/reboot.c
+2-21 files

HardenedBSD/src a8c594dsys/conf files.amd64

files.amd64: remove some lines duplicated from files.x86

These were added to files.x86 because they were duplicated in both
files.i386 and files.amd64, but they did not end up removed in the
latter.  Garbage collect them now.

Reviewed by:    jhibbits
Fixes:  b9c6fa339d9c7 ("files.x86: Pull in some more duplicate [...]")
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Differential Revision:  https://reviews.freebsd.org/D54295
DeltaFile
+0-2sys/conf/files.amd64
+0-21 files

HardenedBSD/src 34892a8sys/compat/linuxkpi/common/include/linux bitops.h, sys/modules Makefile

LinuxKPI: bitcount fix builds with gcc and older llvm

LLVM before 19 and gcc before 14 do not support __builtin_popcountg().
Use __const_bitcount<n> from sys/bitcount.h as a replacement in these
cases.  This should still allow drm-kmod to build where the size needs
to be known at compile-time.

Remove the conditional for gcc around the iwlwifi modules build,
which was collateral damage in all this.

Sponsored by:   The FreeBSD Foundation
Fixes:          7cbc4d875971, 5e0a4859f28a
MFC after:      3 days
Reviewed by:    brooks, emaste (without the sys/modules/Makefile change)
Differential Revision: https://reviews.freebsd.org/D54297
DeltaFile
+8-0sys/compat/linuxkpi/common/include/linux/bitops.h
+0-3sys/modules/Makefile
+8-32 files

HardenedBSD/src 27aa23csys/sys bitcount.h

sys/bitcount.h: add __const_bitcount<n>

Add a version of __const_bitcount<n> which can be used to get the
numbers at compile-time when __builtin_popcountg() is not available
(see sys/compat/linuxkpi/common/include/linux/bitops.h for LLVM before
19 and gcc before 14).

Obtained from:  https://reviews.freebsd.org/D50995#1174884 by obiwac
Sponsored by:   The FreeBSD Foundation
Reviewed by:    brooks, emaste
Differential Revision: https://reviews.freebsd.org/D54301
DeltaFile
+22-0sys/sys/bitcount.h
+22-01 files

HardenedBSD/src 546d3d0sys/contrib/openzfs/contrib/initramfs/scripts zfs, sys/contrib/openzfs/module/os/linux/zfs zfs_ctldir.c

zfs: merge openzfs/zfs at 962e68865

Notable upstream pull request merges:
 #16307 1d43387dd zdb: Add -O option for -r to specify object-id
 #17965 a62c62120 ARC: Pre-convert zfs_arc_min_prefetch_ms
 #17970 d393166c5 ARC: Increase parallel eviction batching
 #17981 20f09eae4 ZIO: ZIO_STAGE_DDT_WRITE is a blocking stage
 #17983 ff47dd35e Fix ddtprune causing space leak
 #18015 86b064469 FreeBSD: Fix a potential null dereference
                  in zfs_freebsd_fsync() (already merged)
 #18020 ff47dd35e Ensure 64-bit `off_t` is used in user space
                  instead of `loff_t`
 #18028 09492e0f2 Reduce dataset buffers re-dirtying
 #18033 f72fd378c Defer async destroys on pool import
 #18043 3d76ba273 Improve async destroy processing timing
 #18044 46d6f1fe5 DDT: Move logs searches out of the lock
 #18047 ff5414406 DDT: Switch to using ZAP _by_dnode() interfaces
 #18048 3b1ff816b DDT: Add/use zap_lookup_length_uint64_by_dnode()
 #18055 22e89aca8 DDT: Fix compressed entry buffer size

    [8 lines not shown]
DeltaFile
+364-299sys/contrib/openzfs/contrib/initramfs/scripts/zfs
+103-66sys/contrib/openzfs/module/zfs/ddt.c
+104-38sys/contrib/openzfs/module/os/linux/zfs/zfs_ctldir.c
+71-42sys/contrib/openzfs/module/zfs/dsl_scan.c
+53-40sys/contrib/openzfs/module/zfs/arc.c
+86-0sys/contrib/openzfs/tests/zfs-tests/tests/functional/dedup/dedup_prune_leak.ksh
+781-48555 files not shown
+1,344-72161 files

HardenedBSD/src f8cee1fcontrib/mtree mtree.c spec.c

Import latest mtree from NetBSD

Merge commit 'eb2ccba0c11b405ac613c3046997765317cc8b5c'

PR:             192839
PR:             219467
MFC after:      1 week
DeltaFile
+22-14contrib/mtree/mtree.c
+11-14contrib/mtree/spec.c
+6-10contrib/mtree/compare.c
+4-3contrib/mtree/create.c
+43-414 files

HardenedBSD/src eb2ccba. mtree.c spec.c

Vendor import of NetBSD's mtree at 2025-12-19
DeltaFile
+22-14mtree.c
+12-15spec.c
+7-11compare.c
+4-3create.c
+45-434 files

HardenedBSD/src fe53a8asys/net bpf_ifnet.c

bpf: add missing IFT_BRIDGE in the write method

Fixes:  8774a990ee4094f16d596d4b78e0f3239e5d0c88
DeltaFile
+1-0sys/net/bpf_ifnet.c
+1-01 files

HardenedBSD/src 5f1126fshare/man/man1 builtin.1, sys/dev/virtio/network if_vtnet.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+43-48sys/netpfil/pf/pf_ioctl.c
+62-0tests/sys/netinet6/ndp.sh
+31-9sys/kern/subr_prf.c
+16-22share/man/man1/builtin.1
+25-9sys/dev/virtio/network/if_vtnet.c
+21-10tests/sys/netinet6/ra.py
+198-9820 files not shown
+271-16326 files

HardenedBSD/src 3ff3fd9share/man/man1 builtin.1, sys/dev/virtio/network if_vtnet.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+43-48sys/netpfil/pf/pf_ioctl.c
+62-0tests/sys/netinet6/ndp.sh
+31-9sys/kern/subr_prf.c
+16-22share/man/man1/builtin.1
+25-9sys/dev/virtio/network/if_vtnet.c
+21-10tests/sys/netinet6/ra.py
+198-9820 files not shown
+271-16326 files

HardenedBSD/src aaa9df6sys/kern init_main.c subr_rman.c, sys/netlink netlink_snl.h

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+37-14sys/netpfil/ipfilter/netinet/ip_sync.c
+39-0usr.sbin/bsdinstall/scripts/mount_aux
+13-9sys/kern/init_main.c
+9-11sys/netlink/netlink_snl.h
+12-0sys/sys/proc.h
+3-9sys/kern/subr_rman.c
+113-439 files not shown
+132-6215 files

HardenedBSD/src 1d9f27csys/kern init_main.c, sys/netlink netlink_snl.h

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+37-179usr.sbin/devinfo/devinfo.c
+37-14sys/netpfil/ipfilter/netinet/ip_sync.c
+39-0usr.sbin/bsdinstall/scripts/mount_aux
+15-11sys/kern/init_main.c
+9-11sys/netlink/netlink_snl.h
+13-1sys/sys/proc.h
+150-21618 files not shown
+185-27024 files

HardenedBSD/src 525766fsys/kern init_main.c

Revert "sys: Bump 32-bit kernel removal to 16.0"

32-bit powerpc and i386 kernels still exist in 14.x, so we don't want to
imply that those may persist until 16.0.  The message only claims that
the kernels "may be" removed in 15.0 anyhow.

This reverts commit c19688407a2c797e74762aebd90c1f1cc70ab726.

Reported by:    jhb
DeltaFile
+1-1sys/kern/init_main.c
+1-11 files

HardenedBSD/src ed6612dusr.sbin/devinfo devinfo.c devinfo.8

Revert "devinfo: Add support for libxo"

This broke the human output formatting in several ways.

This reverts commit 4cf5878d27ddc9d3ca3ed870f88112c3b4f6fb69.
This reverts commit e8d6b58ef5a4afe0d155b6967c92d55f3bbd53fe.
This reverts commit c759aca606cee8352c1d739bf7a762c8a2ed2012.

PR:             291511
Reviewed by:    imp, des
Differential Revision:  https://reviews.freebsd.org/D54196

(cherry picked from commit 43b07bdbc5d24febc7a904d16f05f921c478eaa7)
DeltaFile
+37-179usr.sbin/devinfo/devinfo.c
+1-13usr.sbin/devinfo/devinfo.8
+1-1usr.sbin/devinfo/Makefile
+39-1933 files

HardenedBSD/src 1a67e18sbin/ipf/libipf interror.c, sys/netpfil/ipfilter/netinet ip_sync.c

ipfilter: Prevent stack buffer overflow

When copying ipfs data from user space, don't just check that the payload
length is nonzero, but also that it does not exceed the size of the stack
buffer we're copying it into.

While we're at it, use a union to create a buffer of the exact size we
need instead of guessing that 2048 will be enough (and not too much).

Finally, check the size of the payload once it gets to where it's used.

MFC after:      3 days
Reported by:    Ilja Van Sprundel <ivansprundel at ioactive.com>
Reviewed by:    cy
Differential Revision:  https://reviews.freebsd.org/D54194

(cherry picked from commit a34c50fbd2a52bb63acde82e5aec4cb57880e39b)
DeltaFile
+37-14sys/netpfil/ipfilter/netinet/ip_sync.c
+5-0sbin/ipf/libipf/interror.c
+42-142 files

HardenedBSD/src 00bdb83sys/kern kern_proc.c kern_fork.c

proc: Fix proc_init / proc_dtor ordering issues

* Move the initialization of p_ktr into proc_init() and make the check
  in proc_dtor() unconditional.  Prior to this, it was possible to fail
  and invoke proc_dtor() after the first thread had been created (which
  was the condition for checking p_ktr in proc_dtor()) but before p_ktr
  had been initialized.

* Move the p_klist initialization in fork1() past the last possible
  failure point so we don't have to free it on failure.  We didn't,
  which meant we were leaking a knlist every time we failed to fork
  due to hitting the resource limit.

PR:             291470
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54215

(cherry picked from commit 026d962ef14dafe19fa73361bea6dcc95f141dfa)
DeltaFile
+4-4sys/kern/kern_proc.c
+2-2sys/kern/kern_fork.c
+6-62 files

HardenedBSD/src 90e09bfsys/kern vfs_syscalls.c kern_jail.c

vfs: Let prison_enforce_statfs zero the fsid

Currently, we unconditionally zero the fsid before returning a struct
statfs to a jailed process.  Move this into prison_enforce_statfs() so
it only happens if enforce_statfs is greater than 1, or enforce_statfs
is 1 but the mountpoint is outside the jail.

PR:             291301
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54214

(cherry picked from commit d4f25d0c7957f0f1960028eec82625c2d6405537)
DeltaFile
+1-4sys/kern/vfs_syscalls.c
+3-0sys/kern/kern_jail.c
+4-42 files

HardenedBSD/src 594ed1asbin/ipf/libipf interror.c, sys/netpfil/ipfilter/netinet ip_sync.c

ipfilter: Prevent stack buffer overflow

When copying ipfs data from user space, don't just check that the payload
length is nonzero, but also that it does not exceed the size of the stack
buffer we're copying it into.

While we're at it, use a union to create a buffer of the exact size we
need instead of guessing that 2048 will be enough (and not too much).

Finally, check the size of the payload once it gets to where it's used.

MFC after:      3 days
Reported by:    Ilja Van Sprundel <ivansprundel at ioactive.com>
Reviewed by:    cy
Differential Revision:  https://reviews.freebsd.org/D54194

(cherry picked from commit a34c50fbd2a52bb63acde82e5aec4cb57880e39b)
DeltaFile
+37-14sys/netpfil/ipfilter/netinet/ip_sync.c
+5-0sbin/ipf/libipf/interror.c
+42-142 files

HardenedBSD/src faac795sys/kern kern_proc.c kern_fork.c

proc: Fix proc_init / proc_dtor ordering issues

* Move the initialization of p_ktr into proc_init() and make the check
  in proc_dtor() unconditional.  Prior to this, it was possible to fail
  and invoke proc_dtor() after the first thread had been created (which
  was the condition for checking p_ktr in proc_dtor()) but before p_ktr
  had been initialized.

* Move the p_klist initialization in fork1() past the last possible
  failure point so we don't have to free it on failure.  We didn't,
  which meant we were leaking a knlist every time we failed to fork
  due to hitting the resource limit.

PR:             291470
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54215

(cherry picked from commit 026d962ef14dafe19fa73361bea6dcc95f141dfa)
DeltaFile
+4-4sys/kern/kern_proc.c
+2-2sys/kern/kern_fork.c
+6-62 files

HardenedBSD/src 3ed0824sys/vm vm_glue.c

vm: Fix kstack alignment assertion

The expectation that the allocation will be aligned to the kstack size
only applies when allocating from a kstack arena, not when allocating a
non-standard size from the kernel arena.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Fixes:          7a79d0669761 ("vm: improve kstack_object pindex calculation to avoid pindex holes")
Reviewed by:    bnovkov, siderop1_netapp.com
Differential Revision:  https://reviews.freebsd.org/D54171

(cherry picked from commit a35545ee02680cee04c354b50182dd94d4489666)
DeltaFile
+6-4sys/vm/vm_glue.c
+6-41 files