HardenedBSD/src b7437fbcontrib/less lesskey.nro screen.c, lib/libfetch common.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+47-59sys/dev/asmc/asmc.c
+46-56lib/libfetch/common.c
+48-20contrib/less/lesskey.nro
+37-4contrib/less/screen.c
+21-0contrib/less/NEWS
+13-4contrib/less/charset.c
+212-14352 files not shown
+326-21458 files

HardenedBSD/src 62451ffcontrib/less lesskey.nro screen.c, lib/libfetch common.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+47-59sys/dev/asmc/asmc.c
+46-56lib/libfetch/common.c
+48-20contrib/less/lesskey.nro
+37-4contrib/less/screen.c
+21-0contrib/less/NEWS
+13-4contrib/less/charset.c
+212-14352 files not shown
+326-21458 files

HardenedBSD/src e2abec6contrib/less lesskey.nro screen.c

MFV: less v692.
DeltaFile
+48-20contrib/less/lesskey.nro
+37-4contrib/less/screen.c
+21-0contrib/less/NEWS
+13-4contrib/less/charset.c
+11-5contrib/less/decode.c
+7-7contrib/less/less.nro
+137-4050 files not shown
+233-9956 files

HardenedBSD/src e20e26esys/dev/asmc asmc.c

asmc: code style modernization and minor cleanups

- Allow `ASMC_DEBUG` to be treated as a variadic macro.
- Add ellipses around `sizeof(..)` calls.
- Reindent some of the lines to better follow style(9) with line
  wrapping.

A number of other clang-format changes were not taken as they are not
compatible with style(9).

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55394
DeltaFile
+47-59sys/dev/asmc/asmc.c
+47-591 files

HardenedBSD/src 4be8b0b. less.man lesskey.nro

Vendor import of less v692.
DeltaFile
+470-470less.man
+48-20lesskey.nro
+48-20lesskey.man
+37-4screen.c
+21-0NEWS
+13-4charset.c
+637-51872 files not shown
+862-59978 files

HardenedBSD/src b5d570elib/libfetch common.c

libfetch: Gracefully skip unsupported protocols

If socket() fails because the address family or protocol is unsupported,
just continue with the next address.

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55407
DeltaFile
+5-1lib/libfetch/common.c
+5-11 files

HardenedBSD/src afbdcd4lib/libfetch common.c

libfetch: Fail hard if interrupted while connecting

This fixes an issue where the first address that DNS returns is blocked
by a packet filter, so we hang for a while, then the user hits Ctrl-C,
interrupting connect(2), whereupon we move on to the next address, get
a connection, request the file, and return to fetch(1), which sees that
SIGINT was caught and bails.

Note that we make no attempt to enforce fetchTimeout in the connection
phase, and never have.  It's feasible, but non-trivial, so we'll leave
it as an exercise for future us.

PR:             293312
MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55406
DeltaFile
+7-1lib/libfetch/common.c
+7-11 files

HardenedBSD/src 1b7c4d2lib/libfetch common.c

libfetch: Clean up fetch_info usage

* Provide a wrapper for the common if (verbose) fetch_info(...) idiom.

* Replace remaining instances of fprintf(stderr, ...) with fetch_info().

* Fix a few style nits.

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55405
DeltaFile
+34-54lib/libfetch/common.c
+34-541 files

HardenedBSD/src 4f92075lib/libnetbsd/sys cdefs.h, sbin/nvmecontrol nvmecontrol.8

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+17-5sys/netinet/tcp_subr.c
+16-0lib/libnetbsd/sys/cdefs.h
+3-3sbin/nvmecontrol/nvmecontrol.8
+1-4usr.sbin/ctld/nvmf.cc
+2-1sys/dev/nvmf/nvmf.h
+2-1tools/tools/nvmf/nvmfdd/nvmfdd.c
+41-141 files not shown
+42-157 files

HardenedBSD/src 7c4c78dlib/libnetbsd/sys cdefs.h, sbin/nvmecontrol nvmecontrol.8

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+17-5sys/netinet/tcp_subr.c
+16-0lib/libnetbsd/sys/cdefs.h
+3-3sbin/nvmecontrol/nvmecontrol.8
+1-4usr.sbin/ctld/nvmf.cc
+2-1sys/dev/nvmf/nvmf.h
+2-1tools/tools/nvmf/nvmfdd/nvmfdd.c
+41-141 files not shown
+42-157 files

HardenedBSD/src d1f1402lib/libnetbsd/sys cdefs.h

libnetbsd: import `__CTASSERT(..)` macros

These compile-time assert macros are similar to `Static_assert` on FreeBSD.

These macros are in use in newer versions of `contrib/netbsd-tests`.

Obtained from:  https://github.com/NetBSD/src (c26cc77b3a0b26b95a2)
MFC after:      1 week
DeltaFile
+16-0lib/libnetbsd/sys/cdefs.h
+16-01 files

HardenedBSD/src e188655sys/netinet tcp_subr.c

tcp: improve validation of received TCP over UDP packets

Reviewed by:            glebius, pouria
MFC after:              3 days
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D55410
DeltaFile
+17-5sys/netinet/tcp_subr.c
+17-51 files

HardenedBSD/src 1602f00sbin/nvmecontrol nvmecontrol.8 fabrics.c, sys/dev/nvmf nvmf.h

nvmf: Limit the default I/O queue size to 128 entries

Previously the size defaulted to the maximum supported size reported
by the remote host.  The value of 128 matches the default on Linux and
avoids excessive resource usage for I/O queues.

Sponsored by:   Chelsio Communications
DeltaFile
+3-3sbin/nvmecontrol/nvmecontrol.8
+2-1sys/dev/nvmf/nvmf.h
+2-1tools/tools/nvmf/nvmfdd/nvmfdd.c
+1-1sbin/nvmecontrol/fabrics.c
+8-64 files

HardenedBSD/src 0788e7cusr.sbin/ctld nvmf.cc

ctld: Honor the default maximum I/O queue size for NVMeoF controllers

<dev/nvmf.h> exports a constant to set the default maximum I/O queue
size which is used by ctl(4) if an explicit size is not set.  This
value was chosen to match Linux's default, but it also avoids
excessive resource usage for I/O queues.

ctld was using the absolute maxium size as the default instead.

Sponsored by:   Chelsio Communications
DeltaFile
+1-4usr.sbin/ctld/nvmf.cc
+1-41 files

HardenedBSD/src f7038edsys/amd64/include cpufunc.h, sys/i386/include cpufunc.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+6-20sys/i386/include/cpufunc.h
+6-8sys/amd64/include/cpufunc.h
+5-7tests/sys/netlink/test_rtnl_gre.c
+2-0usr.sbin/fstyp/apfs.c
+2-0usr.sbin/fstyp/cd9660.c
+2-0usr.sbin/fstyp/exfat.c
+23-3517 files not shown
+55-3723 files

HardenedBSD/src eb7fe9esys/amd64/include cpufunc.h, sys/i386/include cpufunc.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+6-20sys/i386/include/cpufunc.h
+6-8sys/amd64/include/cpufunc.h
+5-7tests/sys/netlink/test_rtnl_gre.c
+2-0usr.sbin/fstyp/hfsplus.c
+2-0usr.sbin/fstyp/msdosfs.c
+2-0usr.sbin/fstyp/msdosfs.h
+23-3516 files not shown
+54-3622 files

HardenedBSD/src 32942f8lib/libc/arm/aeabi aeabi_unwind_cpp.c, lib/libsys/arm Makefile.sys

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+6-6lib/libc/arm/aeabi/aeabi_unwind_cpp.c
+5-0lib/libsys/arm/Makefile.sys
+11-62 files

HardenedBSD/src 102fed0share/man/man5 src.conf.5

src.conf.5: Fix "incompatibility" typo

MFC after:      3 days
Reviewed by:    ziaee
Signed-off-by:  Christos Longros <chris.longros at gmail.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/2035
DeltaFile
+1-1share/man/man5/src.conf.5
+1-11 files

HardenedBSD/src 1cb3f59sys/kern kern_shutdown.c

Merge branch 'hardened/current/master___issue72' into 'hardened/current/master'

Harden kernel crashdump interface

See merge request hardenedbsd/HardenedBSD!117
DeltaFile
+1-1sys/kern/kern_shutdown.c
+1-11 files

HardenedBSD/src 49fa007tests/sys/netlink test_rtnl_gre.c

gre tests: Fix gcc warnings on gre netlink tests

Avoid using `snl_add_msg_attr_ip` for now and directly use
`snl_add_msg_attr_ip4` to silence gcc warnings.

Fixes: e1e18cc12e68
Differential Revision: https://reviews.freebsd.org/D54443
DeltaFile
+5-7tests/sys/netlink/test_rtnl_gre.c
+5-71 files

HardenedBSD/src eac62e1lib/libc/arm/aeabi aeabi_unwind_cpp.c

libc/arm: use __builtin_trap() instead of abort() in aeabi_unwind stubs

This avoids a dependency on the abort symbol in libsys.

PR:             292539
Reviewed by:    mmel
Approved by:    markj (mentor)
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55255

(cherry picked from commit 1782bc9a0a8da2d6aca31b7790981e1980c9e4b9)
DeltaFile
+6-6lib/libc/arm/aeabi/aeabi_unwind_cpp.c
+6-61 files

HardenedBSD/src f16349flib/libsys/arm Makefile.sys

libsys/arm: include ARM EABI unwind bits into libsys

libsys required ARM EABI unwind symbols like __aeabi_unwind_cpp_pr0.
These symbols are normally provided by libc, but if a binary does
not link libc, the symbol ends up not being resolved.

Among other problems, this prevented gcc14 and newer from building
on arm.

Add the relevant symbols as hidden symbols into libsys to avoid this
problem.

(this patch was posted by jrtc27 who has asked me to move it along)

PR:             292539
Tested by:      fuz, Mark Millard <marklmi26-fbsd at yahoo.com>
Reviewed by:    mmel
Approved by:    markj (mentor)
MFC after:      1 week

    [3 lines not shown]
DeltaFile
+5-0lib/libsys/arm/Makefile.sys
+5-01 files

HardenedBSD/src 499d0f0usr.sbin/bhyve/amd64 atkbdc.h

bhyve: Add SPDX-License-Identifier tag

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
DeltaFile
+2-0usr.sbin/bhyve/amd64/atkbdc.h
+2-01 files

HardenedBSD/src 89d7b30sys/amd64/include cpufunc.h, sys/i386/include cpufunc.h

i386,amd64: Explicitly set ECX=0 in do_cpuid() to be future-proof

In principle, do_cpuid() should only be used for CPUID leaves without
sub-leaves.  Even accessing sub-leaf zero (ECX=0), one must use
cpuid_count(ax, 0) rather than cpuid(ax).

However, one might assume do_cpuid(ax) is equivalent to
cpuid_count(ax, 0), but the old do_cpuid() did not initialize ECX before
executing the CPUID instruction.  If ECX contained a non-zero value, the
instruction could return unexpected results, potentially leading to
subtle and hard-to-debug issues, especially in ported code.

To be future-proof and to help port code, adjust do_cpuid(ax) to be
cpuid_count(ax, 0) to explicitly set ECX=0.

It's believed that this change does not fix any real bugs in FreeBSD.

See also the DragonFly commit:
https://github.com/DragonFlyBSD/DragonFlyBSD/commit/0087a1d163488a57787a9a6431dd94070b1988d4

    [4 lines not shown]
DeltaFile
+6-20sys/i386/include/cpufunc.h
+6-8sys/amd64/include/cpufunc.h
+12-282 files

HardenedBSD/src 836ac98usr.sbin/fstyp exfat.c ext2fs.c

fstyp: Add SPDX-License-Identifier tags

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
DeltaFile
+2-0usr.sbin/fstyp/exfat.c
+2-0usr.sbin/fstyp/ext2fs.c
+2-0usr.sbin/fstyp/fstyp.c
+2-0usr.sbin/fstyp/fstyp.h
+2-0usr.sbin/fstyp/geli.c
+2-0usr.sbin/fstyp/hammer.c
+12-011 files not shown
+34-017 files

HardenedBSD/src 4333cf0sys/kern kern_cpu.c, sys/x86/cpufreq hwpstate_amd.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+144-54sys/x86/cpufreq/hwpstate_amd.c
+2-6sys/kern/kern_cpu.c
+1-0tests/sys/netlink/test_rtnl_gre.c
+147-603 files

HardenedBSD/src 25d4a9bsys/kern kern_cpu.c, sys/x86/cpufreq hwpstate_amd.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+144-54sys/x86/cpufreq/hwpstate_amd.c
+2-6sys/kern/kern_cpu.c
+1-0tests/sys/netlink/test_rtnl_gre.c
+147-603 files

HardenedBSD/src a709498sys/kern kern_shutdown.c

HBSD: Harden kernel crashdump interface

Previously, anyone on the system (notably a jail's root user) could
successfully call `dumpon -l` and determine which dump device(s) were
configured.

`dumpon -l` uses the sysctl node `kern.shutdown.dumpdevname` as its
comms channel with the kernel for that purpose. (`sysctl kern.shutdown.dumpdevname`
is essentially the same as `dumpon -l` without error handling.)

With this commit we add CTLFLAG_ROOTONLY to that sysctl node, such
that anyone except the root user on the host can access it, ensuring
that `dumpon -l`/`sysctl kern.shutdown.dumpdevname` always fails
inside a jail.
DeltaFile
+1-1sys/kern/kern_shutdown.c
+1-11 files

HardenedBSD/src f1b93fcsys/x86/cpufreq hwpstate_amd.c

hwpstate_amd(4): Fix punctuation in 'desired_performance' knob's description

To be consistent with that of the others.

No functional change.

Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1sys/x86/cpufreq/hwpstate_amd.c
+1-11 files

HardenedBSD/src b69a396sys/x86/cpufreq hwpstate_amd.c

hwpstate_amd(4): CPPC: Allow attaching even if CAPABILITY_1 cannot be read

If that MSR cannot be read, we fallback to defaults specified by the
ACPI specification, as we are already doing when the minimum and maximum
values in there look bogus.

Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D55252
DeltaFile
+28-17sys/x86/cpufreq/hwpstate_amd.c
+28-171 files