HardenedBSD/src f74d583sys/x86/cpufreq hwpstate_amd.c, tools/test/stress2/misc syzkaller95.sh syzkaller98.sh

Merge remote-tracking branch 'origin/freebsd/current/main' into hardened/current/master
DeltaFile
+453-0tools/test/stress2/misc/syzkaller95.sh
+268-0tools/test/stress2/misc/syzkaller98.sh
+265-0tools/test/stress2/misc/syzkaller92.sh
+228-0tools/test/stress2/misc/syzkaller90.sh
+149-78sys/x86/cpufreq/hwpstate_amd.c
+217-0tools/test/stress2/misc/syzkaller91.sh
+1,580-7827 files not shown
+2,550-10133 files

HardenedBSD/src 4f8a1b4tools/test/stress2/misc syzkaller95.sh syzkaller98.sh

stress2: Added syzkaller reproducers. Update the exclude file
DeltaFile
+453-0tools/test/stress2/misc/syzkaller95.sh
+268-0tools/test/stress2/misc/syzkaller98.sh
+265-0tools/test/stress2/misc/syzkaller92.sh
+228-0tools/test/stress2/misc/syzkaller90.sh
+217-0tools/test/stress2/misc/syzkaller91.sh
+194-0tools/test/stress2/misc/syzkaller97.sh
+1,625-05 files not shown
+2,262-311 files

HardenedBSD/src 8d99314etc/mtree BSD.debug.dist BSD.tests.dist

mtree: Add missing entries

Add missing mtree directory entries.  Without them, the resulting
worldstage METALOG file would produce an invalid (incomplete) mtree
specification file.

Reviewed by:    ivy
Differential Revision:  https://reviews.freebsd.org/D56013
DeltaFile
+8-0etc/mtree/BSD.debug.dist
+4-0etc/mtree/BSD.tests.dist
+12-02 files

HardenedBSD/src e23f0deshare/man/man7 security.7, usr.bin/mdo mdo.1

mdo.1: Cross-reference with security.7

MFC after:      3 days
Reviewed by:    olce
Differential Revision:  https://reviews.freebsd.org/D56024
DeltaFile
+3-2usr.bin/mdo/mdo.1
+2-1share/man/man7/security.7
+5-32 files

HardenedBSD/src f0d5f46sys/dev/mlx5 driver.h, sys/dev/mlx5/mlx5_core mlx5_cmd.c

mlx5: postpone freeing the completed command entity to taskqueue

because cancel_delayed_work_sync() might need to sleep, which cannot be
done in the interrupt thread where the completion runs.

Sponsored by:   Nvidia networking
MFC after:      1 week
DeltaFile
+11-1sys/dev/mlx5/mlx5_core/mlx5_cmd.c
+1-0sys/dev/mlx5/driver.h
+12-12 files

HardenedBSD/src b075e44usr.bin/diff3 diff3.c diff3.1, usr.bin/diff3/tests diff3_test.sh conflict-merge.out

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+75-67usr.bin/diff3/diff3.c
+42-3usr.bin/diff3/tests/diff3_test.sh
+25-0usr.bin/diff3/tests/conflict-merge.out
+19-0usr.bin/diff3/tests/conflict-Em.out
+16-1usr.bin/diff3/diff3.1
+16-0usr.bin/diff3/tests/passwd-Em.out
+193-7112 files not shown
+278-7218 files

HardenedBSD/src 434e1c3sbin/pfctl/tests pfctl_test_list.inc, sbin/pfctl/tests/files pf1079.in pf1079.ok

pfctl tests: test rdr-to and nat-to in one rule

OpenBSD fixed this separately (in their 6a338f3f70). We appear to not
have had this bug, but test for it anyway.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+2-0sbin/pfctl/tests/files/pf1079.in
+1-0sbin/pfctl/tests/files/pf1079.ok
+1-0sbin/pfctl/tests/pfctl_test_list.inc
+4-03 files

HardenedBSD/src c1fb42dsys/fs/nfsclient nfs_clstate.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+7-1sys/fs/nfsclient/nfs_clstate.c
+7-11 files

HardenedBSD/src 343ace4sbin/pfctl pfctl.c

pfctl: parser must not ignore error from pfctl_optimize_ruleset()

Ignoring the error may cause pfctl(8) to load inconsistent ruleset
preventing pf(4) to enforce desired policy.

Issue reported and fix suggested by berts _from_ fastmail _dot_ com

'Looks good.' @deraadt

MFC after:      1 week
Obtained from:  OpenBSD, sashan <sashan at openbsd.org>, 9fd28a8cca
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+3-2sbin/pfctl/pfctl.c
+3-21 files

HardenedBSD/src 0b0d34ftests/sys/netpfil/pf nat.sh

pf tests: verify first-match-wins for nat rules

Sponsored by:   Orange Business Services
DeltaFile
+45-0tests/sys/netpfil/pf/nat.sh
+45-01 files

HardenedBSD/src 60baee1release release.sh

release.sh: add chroot cleanup routine

The chroot_cleanup routine handles any cleanup needed post-chroot_setup,
etc. This consists of purely tearing down `${CHROOTDIR}/dev` today, but
might involve additional steps, as needed for custom functions. This
allows end-users to override the various chroot functions without having
to modify code in main() or replicate the unmount procedure in an
equivalent routine setup via the trap builtin.

This change modifies the /dev unmount process to use `umount -f` instead
of `umount`. The latter can result in failures if resources are still
mounted or are running post-build, whereas the former will clean up any
resources still in use by processes running in the chroot at time of
build. Moreover, the `chroot_cleanup` routine is now called when the
script is killed with `SIGINT` and `SIGTERM`, as well as at `EXIT`,
better ensuring that the script's resources are cleaned up in relatively common
scenarios that can be detected/handled.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55450 (as part of a larger change)
DeltaFile
+21-1release/release.sh
+21-11 files

HardenedBSD/src b24fc79release release.sh

release.sh: document user-overriddable functions

This helps others attempting to customize the behavior of `release.sh`.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55450 (as part of a larger change)
DeltaFile
+9-0release/release.sh
+9-01 files

HardenedBSD/src c25976flib/libc/tests/stdlib cxa_thread_atexit_nothr_test.cc cxa_thread_atexit_test.cc

libc: Fix cxa_thread_atexit{,nothr} test.

After patch 9d26b82, we don't provide recursive call protection anymore.
Therefore, to pass the test, we adjust the testcase by protecting on
caller and the testcase is to make sure the dtors is properly handled.

Reported by:    siva
Reviewed by:    kib
Approved by:    markj (mentor)
Fixes:  9d26b82826d9 ("libc: Fix dtor order in __cxa_thread_atexit")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55893
DeltaFile
+8-3lib/libc/tests/stdlib/cxa_thread_atexit_nothr_test.cc
+8-2lib/libc/tests/stdlib/cxa_thread_atexit_test.cc
+16-52 files

HardenedBSD/src 191f47bsys/x86/cpufreq hwpstate_amd.c

hwpstate_amd: Refactor the cpufreq code by using delegation pattenr

We separate the code of CPPC and legacy pstate driver to make it easier
to read.

Reviewed by:    olce
Approved by:    markj (mentor)
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55604
DeltaFile
+149-78sys/x86/cpufreq/hwpstate_amd.c
+149-781 files

HardenedBSD/src 45b0c46usr.bin/diff3 diff3.c

diff3: Add SPDX-License-Identifier tag

Reviewed by: bapt
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55462

(cherry picked from commit 5778700fb8c54a33e5bb00a4a0c4e40fde2edbd9)
DeltaFile
+2-0usr.bin/diff3/diff3.c
+2-01 files

HardenedBSD/src fa37a9eusr.bin/diff3 diff3.c diff3.1

diff3: Produce correct exit status

Use exit status 2 for errors, 1 only to indicate that differences were
found between the inputs (in some operating modes).

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    ngie, bapt
Differential Revision:  https://reviews.freebsd.org/D55608

(cherry picked from commit fe5341287c6c9bacc18879b25ed72ceb42e1c811)
DeltaFile
+13-13usr.bin/diff3/diff3.c
+16-1usr.bin/diff3/diff3.1
+29-142 files

HardenedBSD/src 7cbcf35usr.bin/diff3 diff3.c

diff3: Code cleanup

* Order includes.

* Turn the diff type into an enum.

* Turn an unreachable error message into an assertion.

* Remove unused debugging code.

* Remove some dead assignments.

* Consistently use 1 instead of EXIT_FAILURE.

* Turn a return from main() into an exit().

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    bapt

    [3 lines not shown]
DeltaFile
+19-29usr.bin/diff3/diff3.c
+19-291 files

HardenedBSD/src feef48dusr.bin/diff3 diff3.c

diff3: bump version to the date when the GNU diff3 compat was reached

(cherry picked from commit 5ddfd1db271cc675997a942da599c342ccb53afa)
DeltaFile
+1-1usr.bin/diff3/diff3.c
+1-11 files

HardenedBSD/src 1449573usr.bin/diff3/tests conflict-merge.out conflict-Em.out

diff3: add 3 missing files from the testsuite

Fixes:  2cfca8e710f260b8a1bb1ee5e1836a52e468ef4b
(cherry picked from commit 284a0aa96eb63f12831a9e06514a50b2cd80957f)
DeltaFile
+25-0usr.bin/diff3/tests/conflict-merge.out
+19-0usr.bin/diff3/tests/conflict-Em.out
+44-02 files

HardenedBSD/src 898db3eusr.bin/diff3 diff3.c

diff3: fix diff3 -A

for cases where file2 differs but file1 and file3 agrees, the code
stored the file2 and file3 line numbers in the de[] editing script
entries but used them as if they were file1 line numbers.

Reviewed by:            thj
Differential Revision:  https://reviews.freebsd.org/D55276

(cherry picked from commit 8d442cf32e4fb29fbb85090ac29d32d1e30fd824)
DeltaFile
+24-7usr.bin/diff3/diff3.c
+24-71 files

HardenedBSD/src a6f17ddusr.bin/diff3 diff3.c, usr.bin/diff3/tests diff3_test.sh Makefile

diff3: fix merge mode

Make the merge mode compatible with GNU diff3
Add tests for all the changes, those tests are extracted from the
etcupdate testsuite.

This version passes the etcupdate testsuite and the diffutils diff3
test suite.

MFC After:      1 week

(cherry picked from commit 2cfca8e710f260b8a1bb1ee5e1836a52e468ef4b)
DeltaFile
+25-26usr.bin/diff3/diff3.c
+42-3usr.bin/diff3/tests/diff3_test.sh
+15-1usr.bin/diff3/tests/Makefile
+16-0usr.bin/diff3/tests/passwd-Em.out
+15-0usr.bin/diff3/tests/passwd-test.txt
+12-0usr.bin/diff3/tests/passwd-new.txt
+125-309 files not shown
+168-3015 files

HardenedBSD/src 3797fe7secure/lib/libcrypto Makefile Makefile.inc

libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPIC

This change modifies the libcrypto PIC objects to always compile with
`-DOPENSSL_PIC -fPIC` to restore parity with the upstream build process.
This ensures that the legacy provider is built with parity to the
upstream legacy provider.

MFC after:              12 days
Tested with:            `make check` (legacy provider), `make universe`
Fixes:                  14b9955e
Differential Revision:  https://reviews.freebsd.org/D44896
DeltaFile
+0-6secure/lib/libcrypto/Makefile
+3-0secure/lib/libcrypto/Makefile.inc
+3-62 files

HardenedBSD/src b2fc255sys/fs/nfsclient nfs_clstate.c

nfs_clstate.c: Handle the same stateid case correctly

When an NFSv4.1/4.2 sarver upgrades a read delegation to
a write delegation, it does not need to change the
delegation's stateid.

Without this patch, a DELEGRETURN of the stateid was done
for the case where the delegation stateid had not changed.
This return was bogus, since the delegation stateid now
represents the new write delegation.

This patch fixes the priblem by checking for "same stateid"
and only doing the DELEGRETURN when it is not the same.

PR:     289711

(cherry picked from commit 016570c4463d5908953355ee1cf9a385ad9601b4)
DeltaFile
+7-1sys/fs/nfsclient/nfs_clstate.c
+7-11 files

HardenedBSD/src aeac50frelease/tools vmimage.subr, sbin/newfs newfs.8

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+14-13share/man/man4/acpi.4
+13-4sbin/tunefs/tunefs.c
+10-4sbin/newfs/newfs.8
+3-7sys/dev/acpica/acpi_spmc.c
+6-2sbin/tunefs/tunefs.8
+0-7release/tools/vmimage.subr
+46-3716 files not shown
+96-6322 files

HardenedBSD/src 1ba2961sys/x86/include frame.h

amd64: revert back struct trapframe to the pre-FRED definition

Trying to use the grown struct trapframe for IDT case broke in cases
where code supposed that hardware consumed sizeof(struct trapframe) of
the stack space when delivering interrupt or exception.  In particular,
this was broken for #NM/#DB/#MC.  Naive attempt of using IDT-trapframe
size for stack consumption caused later problems with larger C type.

Instead of pretending that IDT event delivery pushed two never-accessed
doubleword to the stack, keep it honest and provide separate type for
the FRED interrupt frame, i.e. struct trapframe_fred.

Convert between trapframe_fred and trapframe can be done by trivial pointer
arithmetic.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+4-0sys/x86/include/frame.h
+4-01 files

HardenedBSD/src 1d18872sys/compat/linuxkpi/common/include/linux hardirq.h highmem.h

LinuxKPI: add supporting #includes

Compiling drm-kmod on !X86 does not include asm/smp.h which includes
preempt.h on FreeBSD.  In order to compile drm-kmod on other
architectures add the secondary #includes for preempt.h to
spinlock.h and hardirq.h (which now also gets included from highmem.h)
to connect the #include chain.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
PR:             279864
Reviewed by:    jhibbits, emaste
Differential Revision: https://reviews.freebsd.org/D55974
DeltaFile
+1-0sys/compat/linuxkpi/common/include/linux/hardirq.h
+1-0sys/compat/linuxkpi/common/include/linux/highmem.h
+1-0sys/compat/linuxkpi/common/include/linux/spinlock.h
+3-03 files

HardenedBSD/src 2ce06d2sys/kern subr_sbuf.c

sbuf: make assertion message a lot more useable

Saying that we are called with an (un)finished or corrupted sbuf
is like saying "error" (though [un]finished is an extra hint).

Add the pointer to the sbuf so one could easily check it,
add the flags we are checking so one could see quickly about
a possible state mismatch.

Given we already dereference the pointer in the KASSERT there is no
extra harm adding it to the message.

Found while:    testing lindebugfs changes
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    jhb
Differential Revision: https://reviews.freebsd.org/D55919
DeltaFile
+2-2sys/kern/subr_sbuf.c
+2-21 files

HardenedBSD/src 26c8032release/tools ec2-builder.conf ec2-small.conf

HBSD: Resolve merge conflicts

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-5release/tools/ec2-builder.conf
+1-5release/tools/ec2-small.conf
+2-102 files

HardenedBSD/src 8d2f794release/tools vmimage.subr, sbin/newfs newfs.8

Merge remote-tracking branch 'origin/freebsd/current/main' into hardened/current/master

Conflicts:
        release/tools/ec2-builder.conf (unresolved)
        release/tools/ec2-small.conf (unresolved)
DeltaFile
+14-13share/man/man4/acpi.4
+13-4sbin/tunefs/tunefs.c
+10-4sbin/newfs/newfs.8
+3-7sys/dev/acpica/acpi_spmc.c
+6-2sbin/tunefs/tunefs.8
+0-7release/tools/vmimage.subr
+46-3716 files not shown
+104-6322 files

HardenedBSD/src 1186997release/tools ec2.conf

EC2: Remove stale comment

MFC after:      3 days
Sponsored by:   Amazon
DeltaFile
+0-4release/tools/ec2.conf
+0-41 files