BSD Commit Log Search

   pf(4) yet another race between pf_test() and pf_purge_states()

   pf_counters_inc() running on behalf of pf_test() may dereference a
   dead memory left behind pf_purge_states(). The reference to state
   object is still valid, but other items such as radix tables might
   be gone. To stay on the safe side the pf_counters_inc() must
   grab state's mutex and check if state itself is on its death
   row (->timeout == PFTM_UNLINKED). If it is the case then
   pf_counters_inc() must bail out without trying to update counters.

   Issue was kindly reported by Acts1631.

   OK dlg@

   Relax include rules for mpu401.c, not needed for midi-but-no-mpu configs.

   Regen

   Add /dev/midi support, as umidi(4) is found in GENERIC.

   Regen

   Add /dev/radio support, as udsbr(4) is found in GENERIC.

   Remove unused ScifErrCheck() and scif_intr_init(), and comment out currently
   scif_stsoft() which calls are currently commented out.

   Remove unused cpu_reset().

   Fix out-of-bounds read on on missing right bracket after character class.

   The original code checked for a closing bracket before parsing the
   bracket expression.  When character class support was added, that
   closing bracket can now be part of the character class instead.
   Add another check for the closing bracket after parsing character
   classes and roll back if we don't find one.

   Adapted from an OpenSSH bug report.  OK djm@

   Remove unused i82596_proberam().

   Remove unused if_attach_ifq().

   vmd(8): refactor virtio dev init

    - remove line breaks
    - remove useless double checks
    - consistent parentheses around return values
    - fix wrong indentation
    - fix the misleading "calloc failure" message

   go ahead. this looks better. mlarkin@

   vmd(8): Fix double free in the virtio-net TX path

   Report and original diff from Jan Schreiber.

   ok dv@

   Limit the number of pending L2TP connections.  Previously, an
   unlimited number of pending connections could exhaust npppd's memory.

   From acts1631
   ok mvs

   Reject short MPPE packets in npppd.  Short MPPE frame underflowed the
   RC4 length, that caused RC4 to access across memory until it faults.

   From acts1631
   ok mvs

   sync libexpat minor bump

   libexpat has new test files to build;  reminded by tb@

   Update libexpat to version 2.9.0

   Relevant for OpenBSD are security fixes #1392 #1393, bug fixes
   #1387, new features #1327 #1323, other changes #1394 #1399 #1400
   #1401 #1402 #1404 #1405.  Minor library bump is necessary for API
   extension.
   CVE-2026-102633 CVE-2026-77214

   OK tb@

   sys/octeon: span work queue interrupts across CPUs

   It was disabled at octciu.c,v 1.20 to allow fixing logic of ncpus which
   leads to issues with devices where used cnmac wasn't mapped to CPU0

   Now, since the missed splx() was added at clock.c, v1.54 I revert it back.

   OK: visa@

   sys/mips64: add missed splx()

   Seems it was missed since clock.c,v 1.47

   OK visa@

   sys/cnmac: enable HW offload for VLAN

   Tested by Nazarenko Mykyta

   OK: kn@, visa@

   Take a reference to client when menu is opened in case it is closed,
   from someone in GitHub issue 5801.

   Do not show a status message on a client with no session, from someone
   in GitHub issue 5799.

   rpki-client: sort arrays before handling temp files for ca state

   The handling of the tempfiles is placed in the middle of the preparation
   of the arrays to print. This commit moves it a bit down.

   There is no goto err between the calloc and the qsort, so this is safe.

   ok job

   Do not crash when locale(1) is run with "--" as its only argument.

   Spotted by vl_ms on Libera IRC

   Keep dead clients on a list so their queue can be flushed and they are
   not leaked, from someone in GitHub issue 5789.

   Free ranges correctly if style is not terminated, GitHub issue 5795 from
   mail at luftaquila dot io.

   Change back to the original working directory if fork fails when
   spawning a pane, GitHub issue 5793 from hrajyw4 at gmail dot com.

   Clear destination char when converting from wchar_t or the result could
   include stack garbage. GitHub issue 5792 from hrajyw4 at gmail dot com.

   httpd: replace server_match by server_bysocket and server_byname

   This reduces the complexity of the code slightly.

   OK kirill@