HardenedBSD/src 3d6aa06sys/x86/cpufreq hwpstate_amd.c, tools/test/stress2/misc syzkaller95.sh syzkaller98.sh

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+453-0tools/test/stress2/misc/syzkaller95.sh
+268-0tools/test/stress2/misc/syzkaller98.sh
+265-0tools/test/stress2/misc/syzkaller92.sh
+228-0tools/test/stress2/misc/syzkaller90.sh
+149-78sys/x86/cpufreq/hwpstate_amd.c
+217-0tools/test/stress2/misc/syzkaller91.sh
+1,580-7827 files not shown
+2,550-10133 files

HardenedBSD/src f90f0f1release/scripts pkg-stage.sh, release/tools vmimage.subr azure.conf

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+83-113release/tools/vmimage.subr
+85-0usr.bin/yes/tests/yes_test.sh
+54-22usr.bin/yes/yes.c
+39-1share/man/man5/resolver.5
+4-10release/scripts/pkg-stage.sh
+2-11release/tools/azure.conf
+267-15710 files not shown
+291-18016 files

HardenedBSD/src 47402c9tools/build Makefile, tools/build/cross-build/include/mac string.h

cross-build: Provide mempcpy when building on macOS

We could patch the tzcode config to not use it, but it's simple to
provide an implementation of it and avoid spreading cross-build
bootstrapping special cases.

Fixes:          ff2c98b30b57 ("tzcode: Update to 2026a")
MFC after:      1 week
DeltaFile
+3-0tools/build/Makefile
+2-0tools/build/cross-build/include/mac/string.h
+5-02 files

HardenedBSD/src b24b533release release.sh, release/scripts pkg-stage.sh

release: Remove not-NO_ROOT cases

We always use NO_ROOT for release artifact builds, so remove the
alternate code paths.

For the first step we set NO_ROOT unconditionally in cases that invoke
submakes, and turn NO_ROOT being unset into an error in lover-level
targets so that we can catch potential out-of-tree build scripts (or
missed in-tree cases) that expect to run not-NO_ROOT builds.  The second
step will be to remove those entirely.

Reviewed by:    cperciva
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54179

(cherry picked from commit 54e006369c9aab4f3a22f026eb6924c0f9cafda8)
DeltaFile
+83-113release/tools/vmimage.subr
+4-10release/scripts/pkg-stage.sh
+2-11release/tools/azure.conf
+2-8release/tools/vagrant.conf
+2-6release/tools/ec2.conf
+1-3release/release.sh
+94-1516 files

HardenedBSD/src 61f0453release Makefile Makefile.vm

release: Use make's `:H` rather than `/..`

In general we want to strip subdir components, rather than appending
`..`s.

Reviewed by:    lwhsu
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54373

(cherry picked from commit 3949c2b8c4691a6dff8be7b38805d56faab91187)
DeltaFile
+2-2release/Makefile
+1-1release/Makefile.vm
+3-32 files

HardenedBSD/src b5b9517contrib/libcbor CMakeLists.txt, contrib/libcbor/doc/source using.rst

libcbor: Update to 0.13.0

Sponsored by:   The FreeBSD Foundation
DeltaFile
+377-34contrib/libcbor/test/copy_test.c
+225-114contrib/libcbor/CMakeLists.txt
+135-137contrib/libcbor/test/cbor_serialize_test.c
+170-26contrib/libcbor/src/cbor.c
+183-0contrib/libcbor/examples/crash_course.c
+0-174contrib/libcbor/doc/source/using.rst
+1,090-485122 files not shown
+3,665-2,450128 files

HardenedBSD/src f74d583sys/x86/cpufreq hwpstate_amd.c, tools/test/stress2/misc syzkaller95.sh syzkaller98.sh

Merge remote-tracking branch 'origin/freebsd/current/main' into hardened/current/master
DeltaFile
+453-0tools/test/stress2/misc/syzkaller95.sh
+268-0tools/test/stress2/misc/syzkaller98.sh
+265-0tools/test/stress2/misc/syzkaller92.sh
+228-0tools/test/stress2/misc/syzkaller90.sh
+149-78sys/x86/cpufreq/hwpstate_amd.c
+217-0tools/test/stress2/misc/syzkaller91.sh
+1,580-7827 files not shown
+2,550-10133 files

HardenedBSD/src fce6921tests/sys/capsicum linux.cc

Revert "capsicum-test: remove stale file"

This was unintended, sorry.

This reverts commit 20b99e3a147963c6ef715112bd38e349c7a5a459.
DeltaFile
+1,500-0tests/sys/capsicum/linux.cc
+1,500-01 files

HardenedBSD/src 09c5bb3sys/dev/nvmf/controller nvmft_controller.c

nvmf: Fix null ptr reference

Reported by:    Nikolay Denev <ndenev at gmail.com>
Reviewed by:    imp, jhb
Differential Revision:  https://reviews.freebsd.org/D55863
DeltaFile
+1-1sys/dev/nvmf/controller/nvmft_controller.c
+1-11 files

HardenedBSD/src 20b99e3tests/sys/capsicum linux.cc

capsicum-test: remove stale file
DeltaFile
+0-1,500tests/sys/capsicum/linux.cc
+0-1,5001 files

HardenedBSD/src 4f8a1b4tools/test/stress2/misc syzkaller95.sh syzkaller98.sh

stress2: Added syzkaller reproducers. Update the exclude file
DeltaFile
+453-0tools/test/stress2/misc/syzkaller95.sh
+268-0tools/test/stress2/misc/syzkaller98.sh
+265-0tools/test/stress2/misc/syzkaller92.sh
+228-0tools/test/stress2/misc/syzkaller90.sh
+217-0tools/test/stress2/misc/syzkaller91.sh
+194-0tools/test/stress2/misc/syzkaller97.sh
+1,625-05 files not shown
+2,262-311 files

HardenedBSD/src 8d99314etc/mtree BSD.debug.dist BSD.tests.dist

mtree: Add missing entries

Add missing mtree directory entries.  Without them, the resulting
worldstage METALOG file would produce an invalid (incomplete) mtree
specification file.

Reviewed by:    ivy
Differential Revision:  https://reviews.freebsd.org/D56013
DeltaFile
+8-0etc/mtree/BSD.debug.dist
+4-0etc/mtree/BSD.tests.dist
+12-02 files

HardenedBSD/src e23f0deshare/man/man7 security.7, usr.bin/mdo mdo.1

mdo.1: Cross-reference with security.7

MFC after:      3 days
Reviewed by:    olce
Differential Revision:  https://reviews.freebsd.org/D56024
DeltaFile
+3-2usr.bin/mdo/mdo.1
+2-1share/man/man7/security.7
+5-32 files

HardenedBSD/src f0d5f46sys/dev/mlx5 driver.h, sys/dev/mlx5/mlx5_core mlx5_cmd.c

mlx5: postpone freeing the completed command entity to taskqueue

because cancel_delayed_work_sync() might need to sleep, which cannot be
done in the interrupt thread where the completion runs.

Sponsored by:   Nvidia networking
MFC after:      1 week
DeltaFile
+11-1sys/dev/mlx5/mlx5_core/mlx5_cmd.c
+1-0sys/dev/mlx5/driver.h
+12-12 files

HardenedBSD/src 47caac8sys/sys queue.h

queue.h: Reorder STAILQ_INSERT_TAIL

The current implementation briefly violates the tail invariant.  This
is not usually an issue, but if an insert is in flight when a panic
occurs, we may then trip the invariant while dumping core.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    obiwac, olce, jhb
Differential Revision:  https://reviews.freebsd.org/D55819

(cherry picked from commit aa15df4597053c0e95a15b2a7036296999cd562a)
DeltaFile
+2-1sys/sys/queue.h
+2-11 files

HardenedBSD/src c988f31share/man/man5 resolver.5

resolver.5: document six previously undocumented options

Document the edns0, inet6, insecure1, insecure2, no-check-names,
and rotate options which are parsed by res_init(3) but were not
described in the resolver(5) man page.

MFC after:      1 week
Signed-off-by:  Christos Longros <chris.longros at gmail.com>
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D55864

(cherry picked from commit 462a1f6197fa3de63e0eca2835b1d5b0bc6a3bbb)
DeltaFile
+39-1share/man/man5/resolver.5
+39-11 files

HardenedBSD/src 9b6ebd8etc/mtree BSD.tests.dist, usr.bin/yes Makefile

yes: Add tests

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D55802

(cherry picked from commit 67728a18b9c18e55cc60e063380825b80f25b1b9)
DeltaFile
+85-0usr.bin/yes/tests/yes_test.sh
+4-0usr.bin/yes/tests/Makefile
+4-0usr.bin/yes/Makefile
+2-0etc/mtree/BSD.tests.dist
+95-04 files

HardenedBSD/src f2e600fusr.bin/yes yes.c yes.1

yes: Completely overengineer

If we're going to overengineer this, we may as well go all the way.

* If multiple arguments are given, concatenate them into a space-
  separated list like GNU coreutils does.

* When duplicating the expletive, do so exponentially.

* Most importantly, don't modify the memory that argv points to.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans, allanjude
Differential Revision:  https://reviews.freebsd.org/D55617

(cherry picked from commit cf74b63d61b49db848ecc20b87e7ee5f16671320)

yes: Add missing header

    [8 lines not shown]
DeltaFile
+54-22usr.bin/yes/yes.c
+4-2usr.bin/yes/yes.1
+58-242 files

HardenedBSD/src 0427abb. CMakeLists.txt, doc/source using.rst

Vendor import of libcbor 0.13.0

Sponsored by:   The FreeBSD Foundation
DeltaFile
+344-0test/copy_test.c
+183-0examples/crash_course.c
+0-174doc/source/using.rst
+145-4src/cbor.c
+73-36CMakeLists.txt
+109-0examples/cbor_sequence.c
+854-21434 files not shown
+1,334-37440 files

HardenedBSD/src aa1599e. CMakeLists.txt Bazel.md, src CMakeLists.txt

Vendor import of libcbor 0.12.0

Sponsored by:   The FreeBSD Foundation
DeltaFile
+180-106CMakeLists.txt
+135-137test/cbor_serialize_test.c
+80-80src/cbor/internal/builder_callbacks.c
+55-55test/cbor_stream_decode_test.c
+71-37src/CMakeLists.txt
+0-100Bazel.md
+521-515111 files not shown
+2,421-2,166117 files

HardenedBSD/src b075e44usr.bin/diff3 diff3.c diff3.1, usr.bin/diff3/tests diff3_test.sh conflict-merge.out

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+75-67usr.bin/diff3/diff3.c
+42-3usr.bin/diff3/tests/diff3_test.sh
+25-0usr.bin/diff3/tests/conflict-merge.out
+19-0usr.bin/diff3/tests/conflict-Em.out
+16-1usr.bin/diff3/diff3.1
+16-0usr.bin/diff3/tests/passwd-Em.out
+193-7112 files not shown
+278-7218 files

HardenedBSD/src 434e1c3sbin/pfctl/tests pfctl_test_list.inc, sbin/pfctl/tests/files pf1079.in pf1079.ok

pfctl tests: test rdr-to and nat-to in one rule

OpenBSD fixed this separately (in their 6a338f3f70). We appear to not
have had this bug, but test for it anyway.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+2-0sbin/pfctl/tests/files/pf1079.in
+1-0sbin/pfctl/tests/files/pf1079.ok
+1-0sbin/pfctl/tests/pfctl_test_list.inc
+4-03 files

HardenedBSD/src c1fb42dsys/fs/nfsclient nfs_clstate.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+7-1sys/fs/nfsclient/nfs_clstate.c
+7-11 files

HardenedBSD/src 343ace4sbin/pfctl pfctl.c

pfctl: parser must not ignore error from pfctl_optimize_ruleset()

Ignoring the error may cause pfctl(8) to load inconsistent ruleset
preventing pf(4) to enforce desired policy.

Issue reported and fix suggested by berts _from_ fastmail _dot_ com

'Looks good.' @deraadt

MFC after:      1 week
Obtained from:  OpenBSD, sashan <sashan at openbsd.org>, 9fd28a8cca
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+3-2sbin/pfctl/pfctl.c
+3-21 files

HardenedBSD/src 0b0d34ftests/sys/netpfil/pf nat.sh

pf tests: verify first-match-wins for nat rules

Sponsored by:   Orange Business Services
DeltaFile
+45-0tests/sys/netpfil/pf/nat.sh
+45-01 files

HardenedBSD/src 60baee1release release.sh

release.sh: add chroot cleanup routine

The chroot_cleanup routine handles any cleanup needed post-chroot_setup,
etc. This consists of purely tearing down `${CHROOTDIR}/dev` today, but
might involve additional steps, as needed for custom functions. This
allows end-users to override the various chroot functions without having
to modify code in main() or replicate the unmount procedure in an
equivalent routine setup via the trap builtin.

This change modifies the /dev unmount process to use `umount -f` instead
of `umount`. The latter can result in failures if resources are still
mounted or are running post-build, whereas the former will clean up any
resources still in use by processes running in the chroot at time of
build. Moreover, the `chroot_cleanup` routine is now called when the
script is killed with `SIGINT` and `SIGTERM`, as well as at `EXIT`,
better ensuring that the script's resources are cleaned up in relatively common
scenarios that can be detected/handled.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55450 (as part of a larger change)
DeltaFile
+21-1release/release.sh
+21-11 files

HardenedBSD/src b24fc79release release.sh

release.sh: document user-overriddable functions

This helps others attempting to customize the behavior of `release.sh`.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55450 (as part of a larger change)
DeltaFile
+9-0release/release.sh
+9-01 files

HardenedBSD/src c25976flib/libc/tests/stdlib cxa_thread_atexit_nothr_test.cc cxa_thread_atexit_test.cc

libc: Fix cxa_thread_atexit{,nothr} test.

After patch 9d26b82, we don't provide recursive call protection anymore.
Therefore, to pass the test, we adjust the testcase by protecting on
caller and the testcase is to make sure the dtors is properly handled.

Reported by:    siva
Reviewed by:    kib
Approved by:    markj (mentor)
Fixes:  9d26b82826d9 ("libc: Fix dtor order in __cxa_thread_atexit")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55893
DeltaFile
+8-3lib/libc/tests/stdlib/cxa_thread_atexit_nothr_test.cc
+8-2lib/libc/tests/stdlib/cxa_thread_atexit_test.cc
+16-52 files

HardenedBSD/src 191f47bsys/x86/cpufreq hwpstate_amd.c

hwpstate_amd: Refactor the cpufreq code by using delegation pattenr

We separate the code of CPPC and legacy pstate driver to make it easier
to read.

Reviewed by:    olce
Approved by:    markj (mentor)
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55604
DeltaFile
+149-78sys/x86/cpufreq/hwpstate_amd.c
+149-781 files

HardenedBSD/src 45b0c46usr.bin/diff3 diff3.c

diff3: Add SPDX-License-Identifier tag

Reviewed by: bapt
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55462

(cherry picked from commit 5778700fb8c54a33e5bb00a4a0c4e40fde2edbd9)
DeltaFile
+2-0usr.bin/diff3/diff3.c
+2-01 files