Add '-p' to sftp mkdir/lmkdir to create directories as required
The -p option causes the mkdir and lmkdir commands to create any missing
intermediate directories. If '-p' is specified, it is not considered an
error if a directory already exists.
With / OK djm@
relayctl: rename "empty" to "unavailable" in table status
The word empty suggested the table has no hosts configured. It really means
the table has no hosts currently up, so unavailable describes the state more
clearly.
OK kirill@
rpki-client: split a large chunk of cms_parse_validate() into a helper
There is a huge messy part in the CMS validation code that deals with
things needing the SignerInfo (the OpenSSL version of it, that is).
All this stuff does not need cleanup at exit and is very long, boring
and meandering code which is concerned with requirements from RFC 6488
which are largely independent of the econtent validation and parsing.
So pull all this into a helper and pass in the few things we need.
The only info we want to retain is that the object is well-formed and
its signtime. Since we need to pass in the cert, we call the helper
after extraction and before validation of the signtime against the cert.
The main point is that cms_parse_validate() finally becomes somewhat
manageable in size.
ok job
Add proper program bound checks to the bpf engine
Introduce new bpf functions _bpf_lfilter and bpf_lfilter which properly
bound check the bpf program and ensure that no jump instruction goes
out of bound. The old bpf_filter and _bpf_filter functions pass a len of
zero and bypass the bound checks.
In the kernel bpf_mfilter now uses the bpf_program (which includes the len)
and by that all calls are bounded.
In userland pcap_offline_filter uses now bpf_lfilter and is bounded.
Direct calls to bpf_filter and _bpf_filter don't do bound checking and
should no longer be used. These functions will be removed from our libpcap
soon.
Fix for libpcap CVE-2026-31912.
Fix various minor things in our bpf implementation
In userland it is possible to call bpf_filter / pcap_offline_filter
with unverified bpf programs. Because of this harden bpf_filter further
by adding the following extra checks:
- Ensure that load and store operations to the scratch memory store are
always bound checked.
- Ensure that no division or modulo by zero is done.
- No longer do shift operations with a too large shift exponent. Instead
zero out the result.
- No longer call abort on unknown instructions when bpf_filter is run
in userland. Use the same return 0 as is already done in the kernel.
On top of this ensure that no unhandled instruction encoding makes it
through bpf_validate by using the same case handling as bpf_filter.
This are fixes for libpcap CVE-2026-0799, CVE-2026-6244, CVE-2026-6554,
CVE-2026-31911. None of the above CVEs are applicable to or kernel since
[2 lines not shown]
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
OK: kettenis@
Fix resuming the secondary CPUs when resuming from hibernation. Like on
amd64, park the CPUs before unpacking the hibernate image. On arm64 we
park the CPUs somewhere safe in the kernel. When we unpark the CPUs,
we need to locate its struct cpu_info and stack as these are dynamically
allocated and the booted kernel may have allocated them in a different
location.
ok deraadt@
Add some memory barriers to make writing out the hibernate image work
on the Radxa Dragon Q6A. Moving forward we really need a side-effect free
bus_dmamap_sync(9), but a memory barrier will do the job as long as the
hardware has cache-coherent DMA.
ok mglocker@
Use getexecpath(3). Since this is crucial build tooling, if getexecpath(3)
fails, fallback to the old method in case someone tries to build on an old
system. Future clang updates should not contain this fallback code chunk.
ok kettenis
Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
and execv(3).
(this lpd is an incomplete replacement which has never been finished, but
maybe eventually someone will finish it...)
Use getexecpath(3) in florian's privsep fork+exec daemons. These programs
are normally started from rc(8) which provides absolute-paths, so these
daemons were trusting argv[0] to be safe, unlike the paranoid behaviour in
sshd(8). If the daemon is started manually without absolute-path, execvp(2)
was being used which walks $PATH (includes /sbin and /usr/sbin) and it works
but isn't ideal. Since getexecpath(3) now always provides a
realpath(3)-style canonicalized absolute path, execv(2) can be used instead.
Use getexecpath(3); if it fails use argv[0] as before with the pre-existing
code to validate it is an absolute path. Here's a bit of history: sshd
became the first fork+exec privsep daemon (I did some arm-twisting).
That privsep has recently turned into fork+exec different binaries but
the SIGHUP restart code still want to re-run the binary from the original path.
The rc startup sequence always passes an absolute path. sshd was paranoid
and validated it. That made hand-restarts of sshd without absolute paths
not work. getexecpath(3) improves the ergonomics.
ok djm
