Update libexpat to version 2.8.4
Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
changes #1315 #1325 #1334 #1340 #1319 #1320. Library bump is not
necessary.
CVE-2026-66046CVE-2026-76641CVE-2026-76957
OK tb@
Use unveil(2) and clamp down on pledge(2).
The main() program establishes a baseline, allowing the maximum
that might ever be needed: stdio rpath and read access to the MAN_DIR.
The top level page generators (pg_show, pg_search) narrow unveil(2)
to the specific manual page tree selected by the user.
When the selected manual page file has been opened, the pledge is narrowed
to just stdio (in resp_catman, resp_format, pg_searchres, pg_index).
Except for internal errors and bad requests, which error out early,
exactly one of these narrowing codepaths is always trodden.
uaudio: Set the rate before the alternate setting of UAC2 devices
Unlike UAC1 devices, UAC2 devices set their sample rate with their
clock unit which is independent of the alternate setting. The Neural
DSP Quad Cortex Mini (and probably others) requires the sample rate to
be set before the alternate setting is switched.
From Laurence Tratt <laurie at tratt.net>, thanks!
uaudio: Enable implicit feedback on devices that claim to support it
The Behringer UMC204HD appears to have broken explicit feedback (the
sync endpoint sends always zeros) resulting in periodic drops.
Enabling implicit feedback (i.e. adjust play-direction data rate to
record-direction one) fixes this device.
From Artem Sheldyaev <artem at sheldyaev.org>, thanks!
httpd: reject shared TLS listeners with different client CA or CRL
Virtual hosts on the same address and port share one TLS context, and
only the first hosts client CA and CRL are used. A client certificate
accepted there reaches every host on the listener, including one meant
to be restricted to a different CA. Such a configuration is now rejected
instead of silently ignored.
Bug report and diff by Acts1631
OK kirill@ claudio@
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
Save CET state on Intel vmm(4) hosts before vm entry.
On Intel hosts with CET support, vmm must set the host CET related
state in the VMCS so VMX will restore it on vm exit. vmm was not
setting this before vm entry resulting in VMX disabling CET on host
cpus when returning to the kernel.
Additionally, vmm should explicitly zero the initial guest state
related to CET and supervisor shadow stacks instead of relying on
the memory backing the VMCS to have been zeroed.
ok mlarkin@
Prevent a vmm(4) vcpu getting stuck if copyin(9) fails.
The VMM_IOC_RUN handler performed copyin after toggling the vcpu
state to running and didn't properly reset it if copyin fails. This
would prevent any subsequent attempt by a caller to issue VMM_IOC_RUN
for the vcpu.
Instead of adding complexity to the error handling path, perform
the copyin first before toggling the state.
ok mlarkin@
Fix a kernel memory leak in vmm(4) VMX deinit.
On Intel VMX hosts, the page of kernel memory allocated for the MSR
bitmap wasn't being freed when deinitializing a vm. (AMD SVM deinit
unaffected.)
ok mlarkin@
NULL kernel pointers in nfs statfs(2) mount_info
nfs differs from other filesystems in that mount arguments can come from
both user and kernel space.
nfs_mount() sets args->fh to a kernel pointer. When root is on nfs,
nfs_boot_getfh() also sets addr and hostname to kernel pointers.
problem found and changes suggested by Andrew Griffiths
ok miod@ millert@ deraadt@
Stop scanning the inactive page queue when we're out of resources needed
to swap pages out. By starting a fresh scan the next time the pagedaemon
gets woken up we do a better job swapping out the least recently used
pages. Any pages we skipped are likely to have been taken of the list
or unbusy the next time around. And scanning the queue until the end
mostly makes the pagedaemon do useless work with the page queue lock
held.
Also avoid inflating the inactive shortage if the free page shortage is
high. Reducing the number of active pages to (almost) zero is
counterproductive since it prevents processes from making progress,
including those that may free up some memory.
ok kirill@, beck@
