LLVM now emits calls to strlen(3) and wcslen(3). Redirect those calls to
our hidden aliases to prevent unnecessary PLT entries (like we already do
for memmove(3), memcpy(4) and memset(3)).
ok deraadt@
login_ldap(8)/ldap(1): fix endless loop
Goto fail on closed socket and check for evbuffer_add(3) errors, too.
Original bug was reported by Matthias Pitzl.
On Tue, Jun 30, 2026 at 11:35:32AM +0200, Martijn van Duren wrote:
> Could you also make sure other aldap.c users get the fix?
OK martijn@
partially revert previous to return to 64-byte submission queue
entries by default, only applying 128-byte entries on APPLE_NVME3
(T2) where we know it's needed
the previous change broke APPLE_NVME2 which advertises 128 bytes but
needs 64
ok dlg
Yet another AI assisted report has triggered on the belief that
kill(2) against 0 (for pgrp) should not be permitted by pledge "proc".
Nothing validates this premise. Blocking process group kills would
break substantial amounts of software in dangeous ways, as it creates
fragile invarient conditions. We previously tried to block this belief
with kern_pledge.c:1.357 by subtly adding "/pgrp" in a comment, but that
was not effective so try adding "kill(2) may still operate on the
process group with pid 0." to the manual page. This is annoying
because the pledge manual page usually describes what is blocked
(resulting in process killing) rather than specifically listing
what allowed.
Discussed with Ivan Arce
clang-scan-deps moved to base, drop lang/clang module
amd64/arm64/i386 snaps now have said tool, make sure you use a recent
enough snap. Tested by tb & me, ok tb@
sys: check vnode identity after vget
Several vnode lookup paths keep a vnode pointer from a filesystem hash,
node tree, or alias list, then call vget() after dropping or lacking the
lookup side protection. If the vnode is recycled while vget() waits, the
pointer can still name a valid struct vnode, but no longer the object
found by the lookup.
Record v_id before vget() and retry the lookup if the id changes after
the vnode is locked. This matches the existing namecache pattern and
turns stale vnode hits into lookup retries instead of returning the
wrong object.
OK: claudio@
