HardenedBSD/src cbf7264share/man/man9 bitset.9 cpuset.9, sys/fs/nfsclient nfs_clbio.c nfs_clvnops.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+151-98usr.sbin/bhyve/bhyve.8
+47-190sys/fs/nfsclient/nfs_clbio.c
+39-0share/man/man9/bitset.9
+2-22sys/fs/nfsclient/nfs_clvnops.c
+8-11sys/fs/nfsclient/nfs_clnfsiod.c
+15-0share/man/man9/cpuset.9
+262-3218 files not shown
+281-32814 files

HardenedBSD/src 2873b9dshare/man/man9 bitset.9 cpuset.9, sys/fs/nfsclient nfs_clbio.c nfs_clvnops.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+151-98usr.sbin/bhyve/bhyve.8
+47-190sys/fs/nfsclient/nfs_clbio.c
+39-0share/man/man9/bitset.9
+2-22sys/fs/nfsclient/nfs_clvnops.c
+8-11sys/fs/nfsclient/nfs_clnfsiod.c
+15-0share/man/man9/cpuset.9
+262-3218 files not shown
+281-32814 files

HardenedBSD/src aaf240fsys/dev/wtap if_wtap.c, sys/dev/wtap/wtap_hal hal.c

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+10-23sys/fs/nfsclient/nfs_clrpcops.c
+1-22sys/fs/nfsclient/nfs_clstate.c
+4-12sys/fs/nfsserver/nfs_nfsdstate.c
+2-8sys/fs/nfsserver/nfs_nfsdserv.c
+2-2sys/dev/wtap/wtap_hal/hal.c
+1-1sys/dev/wtap/if_wtap.c
+20-682 files not shown
+21-708 files

HardenedBSD/src 89bea3csys/amd64/vmm/amd ivrs_drv.c, sys/dev/wtap if_wtap.c

Merge branch 'freebsd/13-stable/main' into hardened/13-stable/master
DeltaFile
+4-12sys/fs/nfsserver/nfs_nfsdstate.c
+2-8sys/fs/nfsserver/nfs_nfsdserv.c
+2-2sys/dev/wtap/wtap_hal/hal.c
+1-1sys/dev/wtap/if_wtap.c
+1-1sys/amd64/vmm/amd/ivrs_drv.c
+10-245 files

HardenedBSD/src 3ad3a5fsys/amd64/vmm/amd ivrs_drv.c

vmm(4): Fix a typo in a kernel message

- s/cant/can't/

(cherry picked from commit 8b5c5cae92d5b44f03636540a787fd6e994ce816)
DeltaFile
+1-1sys/amd64/vmm/amd/ivrs_drv.c
+1-11 files

HardenedBSD/src 5f9d770sys/dev/wtap if_wtap.c, sys/dev/wtap/wtap_hal hal.c

wtap: Fix typos in kernel messages

- s/cant/can't/

(cherry picked from commit 026520a5f2d2ec01e19494c37b87448df86ef21a)
DeltaFile
+2-2sys/dev/wtap/wtap_hal/hal.c
+1-1sys/dev/wtap/if_wtap.c
+3-32 files

HardenedBSD/src 025a5f6sys/amd64/vmm/amd ivrs_drv.c

vmm(4): Fix a typo in a kernel message

- s/cant/can't/

(cherry picked from commit 8b5c5cae92d5b44f03636540a787fd6e994ce816)
DeltaFile
+1-1sys/amd64/vmm/amd/ivrs_drv.c
+1-11 files

HardenedBSD/src 770e03asys/dev/wtap if_wtap.c, sys/dev/wtap/wtap_hal hal.c

wtap: Fix typos in kernel messages

- s/cant/can't/

(cherry picked from commit 026520a5f2d2ec01e19494c37b87448df86ef21a)
DeltaFile
+2-2sys/dev/wtap/wtap_hal/hal.c
+1-1sys/dev/wtap/if_wtap.c
+3-32 files

HardenedBSD/src b30a7e5usr.sbin/bhyve bhyve.8

bhyve.8: Update and rearrange to improve readability

bhyve's man page is a very long block of text that has grown to
proportions that make it hard to read.  In particular, the level of
nesting of various content means man can no longer render the text in a
user-friendly way.

To remedy this:
- move the -s argument documentation into a separate section and
  reformat the various arguments so they are consistent
- add documentation on how to use the -o config.dump feature
- make the listing of various arguments more consistent
- consolidated duplicate listings of TPM backends
- add an example for the config.dump feature
- fix various formatting inconsistencies.

Reviewed by:    emaste, imp, jrm, Pau Amma <pauamma at gundo.com>, rgrimes
Differential Revision:  https://reviews.freebsd.org/D43940
DeltaFile
+151-98usr.sbin/bhyve/bhyve.8
+151-981 files

HardenedBSD/src fba9065sys/fs/nfsserver nfs_nfsdstate.c nfs_nfsdserv.c

Revert "nfsd: Fix NFSv4.1/4.2 Claim_Deleg_Cur_FH"

This reverts commit f300335d9aebf2e99862bf783978bd44ede23550.

It turns out that the old code was correct and it was wireshark
that was broken and indicated that the RPC's XDR was bogus.
Found during IETF bakeathon testing this week.

(cherry picked from commit 54c3aa02e926268ba5551cd7d28fddf38b3589a2)
DeltaFile
+4-12sys/fs/nfsserver/nfs_nfsdstate.c
+2-8sys/fs/nfsserver/nfs_nfsdserv.c
+6-202 files

HardenedBSD/src aab7104sys/fs/nfsserver nfs_nfsdstate.c nfs_nfsdserv.c

Revert "nfsd: Fix NFSv4.1/4.2 Claim_Deleg_Cur_FH"

This reverts commit f300335d9aebf2e99862bf783978bd44ede23550.

It turns out that the old code was correct and it was wireshark
that was broken and indicated that the RPC's XDR was bogus.
Found during IETF bakeathon testing this week.

(cherry picked from commit 54c3aa02e926268ba5551cd7d28fddf38b3589a2)
DeltaFile
+4-12sys/fs/nfsserver/nfs_nfsdstate.c
+2-8sys/fs/nfsserver/nfs_nfsdserv.c
+6-202 files

HardenedBSD/src c946279cddl/lib/libnvpair Makefile, share/man/man5 src.conf.5

HBSD: Resolve merge conflicts

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-6cddl/lib/libnvpair/Makefile
+1-5share/man/man5/src.conf.5
+1-112 files

HardenedBSD/src 6d5a643contrib/llvm-project/libcxx/include regex, contrib/llvm-project/libcxx/src locale.cpp

Merge remote-tracking branch 'internal/hardened/current/master' into hardened/current/cross-dso-cfi

Conflicts:
        cddl/lib/libnvpair/Makefile (unresolved)
        share/man/man5/src.conf.5 (unresolved)
DeltaFile
+20,997-20,920contrib/llvm-project/llvm/lib/Support/UnicodeNameToCodepointGenerated.cpp
+8,621-6,629contrib/xz/ChangeLog
+4,499-5,385contrib/llvm-project/libcxx/src/locale.cpp
+3,748-4,889contrib/llvm-project/libcxx/include/regex
+7,713-0contrib/unbound/util/configparser.c
+7,627-0contrib/unbound/util/configlexer.c
+53,205-37,82315,239 files not shown
+1,349,003-1,091,48015,245 files

HardenedBSD/src 2fe5dc8sys/fs/nfsclient nfs_clrpcops.c nfs_clstate.c

nfscl: Revert part of commit 196787f79e67

Commit 196787f79e67 erroneously assumed that the client code for
Open/Claim_deleg_cur_FH was broken, but it was not.
It was actually wireshark that was broken and indicated
that the correct XDR was bogus.

This reverts the part of 196787f79e67 that changed the arguments for
Open/Claim_deleg_cur_FH.

Found during the IETF bakeathon testing event this week.

(cherry picked from commit 8efba70d7914324890b1f8fe3079036eb2b5c3db)
DeltaFile
+10-23sys/fs/nfsclient/nfs_clrpcops.c
+1-22sys/fs/nfsclient/nfs_clstate.c
+0-1sys/fs/nfsclient/nfsmount.h
+11-463 files

HardenedBSD/src cd4bd97share/man/man9 bitset.9 cpuset.9, sys/sys bitset.h cpuset.h

bitset: Add ORNOT macros

Macros to ANDNOT a bitset currently exist, but there are no ORNOT
equivalents. Introduce ORNOT macros for bitset(9), cpuset(9), and
domainset(9).

Approved by:    markj (mentor)
Reviewed by:    markj
MFC after:      1 week
Sponsored by:   NIKSUN, Inc.
Differential Revision:  https://reviews.freebsd.org/D44976
DeltaFile
+39-0share/man/man9/bitset.9
+15-0share/man/man9/cpuset.9
+14-0sys/sys/bitset.h
+3-0share/man/man9/Makefile
+1-0sys/sys/cpuset.h
+1-0sys/sys/domainset.h
+73-06 files

HardenedBSD/src 03a39a1sys/fs/nfs nfsport.h nfs_commonport.c, sys/fs/nfsclient nfs_clbio.c nfs_clvnops.c

nfscl: Clear out a lot of cruft related to B_DIRECT

There is only one place in the unpatched sources where B_DIRECT is
set in the NFS client and this code is never executed. As such, this patch
removes this code that is never executed, since B_DIRECT should never
be set.

During a IETF testing event this week, I saw a crash in ncl_doio_directwrite(),
but this function is only called if B_DIRECT is set.
I cannot explain how ncl_doio_directwrite() got called, but once this patch
was applied to the sources, the crash did not recur. This is not surprising,
since this patch deleted the function.

Reviewed by:    kib, markj
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D44980
DeltaFile
+47-190sys/fs/nfsclient/nfs_clbio.c
+2-22sys/fs/nfsclient/nfs_clvnops.c
+8-11sys/fs/nfsclient/nfs_clnfsiod.c
+0-3sys/fs/nfsclient/nfsnode.h
+0-2sys/fs/nfs/nfsport.h
+0-1sys/fs/nfs/nfs_commonport.c
+57-2291 files not shown
+57-2307 files

HardenedBSD/src 7cd8df6bin/uuidgen uuidgen.1

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+24-0bin/uuidgen/uuidgen.1
+24-01 files

HardenedBSD/src 6e74b60bin/uuidgen uuidgen.1

uuidgen(1): Add EXAMPLES to manual page

Approved by:            manpages@ (gbe@)
Reviewed by:            gbe@, pauamma
Differential Revision:  https://reviews.freebsd.org/D43494
DeltaFile
+24-0bin/uuidgen/uuidgen.1
+24-01 files

HardenedBSD/src f935a7esys/compat/linux linux_socket.c, sys/fs/unionfs union_vnops.c

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+15-7sys/fs/unionfs/union_vnops.c
+13-0sys/compat/linux/linux_socket.c
+4-0sys/netinet/if_ether.c
+1-1sys/net/if_arp.h
+33-84 files

HardenedBSD/src b07ba4abin/cp utils.c cp.c, sys/fs/nullfs null_vfsops.c

Merge branch 'freebsd/13-stable/main' into hardened/13-stable/master
DeltaFile
+122-285usr.bin/xinstall/xinstall.c
+12-19usr.bin/xinstall/install.1
+21-8bin/cp/utils.c
+9-4bin/cp/cp.c
+8-0usr.bin/xinstall/tests/install_test.sh
+4-3sys/fs/nullfs/null_vfsops.c
+176-3194 files not shown
+183-32210 files

HardenedBSD/src c8d6c93sys/fs/unionfs union_vnops.c

unionfs_lookup(): fix wild accesses to vnode private data

There are a few spots in which unionfs_lookup() accesses unionfs vnode
private data without holding the corresponding vnode lock or interlock.

Reviewed by:            kib, olce
Differential Revision:  https://reviews.freebsd.org/D44601

(cherry picked from commit b18029bc59d2ed6b0eeeb233189cf713b34b467c)
DeltaFile
+15-7sys/fs/unionfs/union_vnops.c
+15-71 files

HardenedBSD/src 82c8a5fsys/fs/nullfs null_vfsops.c

nullfs: Show correct exported flag.

MFC after:      3 days
Reviewed by:    allanjude, kib
Differential Revision:  https://reviews.freebsd.org/D44773

(cherry picked from commit 2b258dd17caf329bc549f93d9858b74109a479d7)
DeltaFile
+4-3sys/fs/nullfs/null_vfsops.c
+4-31 files

HardenedBSD/src 44101ebusr.bin/xinstall xinstall.c install.1, usr.bin/xinstall/tests install_test.sh

install: Always use a temporary file.

Previously, we would only use a temporary file if explicitly asked to
with the `-S` option, and even then, only if the target file already
existed.  This meant that an outside observer looking for the target
file might see a partial file, and might see the file disappear and
then reappear.

With this patch, we always use a temporary file, ensuring atomicity.
The downside is slightly increased disk usage.  The upside is never
having to worry about, for instance, cron jobs randomly failing if
they happen to run simultaneously with `make installworld`.

The `-S` option is retained, partly for compatibility, and partly
to control the use of `fsync(2)`, which has a non-negligible cost
(approximately 10% increase in wall time for `make installworld`).

MFC after:      1 week
Sponsored by:   Klara, Inc.

    [52 lines not shown]
DeltaFile
+122-285usr.bin/xinstall/xinstall.c
+12-19usr.bin/xinstall/install.1
+8-0usr.bin/xinstall/tests/install_test.sh
+142-3043 files

HardenedBSD/src 1799750bin/cp utils.c cp.c

cp: Clarify an obscure comment.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    allanjude
Differential Revision:  https://reviews.freebsd.org/D44805

(cherry picked from commit 64d6925d1901637125f9f739282e72c992657dc8)

cp: Additional sanity check.

Once we've successfully opened the file we've been asked to copy, check
that it's of the same type as FTS told us it was.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    allanjude, markj
Differential Revision:  https://reviews.freebsd.org/D44806


    [8 lines not shown]
DeltaFile
+21-8bin/cp/utils.c
+9-4bin/cp/cp.c
+30-122 files

HardenedBSD/src 1d06b45sys/fs/devfs devfs_vfsops.c, sys/fs/fdescfs fdesc_vfsops.c

Fix MNT_IGNORE for devfs, fdescfs and nullfs

The MNT_IGNORE flag can be used to mark certain filesystem mounts so
that utilities such as df(1) and mount(8) can filter out those mounts by
default. This can be used, for instance, to reduce the noise from
running container workloads inside jails which often have at least three
and sometimes as many as ten mounts per container.

The flag is supplied by the nmount(2) system call and is recorded so
that it can be reported by statfs(2). Unfortunately several filesystems
override the default behaviour and mask out the flag, defeating its
purpose. This change preserves the MNT_IGNORE flag for those filesystems
so that it can be reported correctly.

MFC after:      1 week

(cherry picked from commit b5c4616582cebdcf4dee909a3c2f5b113c4ae59e)
DeltaFile
+1-1sys/fs/devfs/devfs_vfsops.c
+1-1sys/fs/fdescfs/fdesc_vfsops.c
+1-1sys/fs/nullfs/null_vfsops.c
+3-33 files

HardenedBSD/src 90499f6sys/net if_arp.h, sys/netinet if_ether.c

Support ARP for 802 networks

This is used by 802.3 Ethernet.  (Also be used by 802.4 Token Bus and
802.5 Token Ring, but we don't support those.)

This was accidentally removed along with FDDI support in commit
0437c8e3b198, presumably because comments implied it was used only by
FDDI or Token Ring.

Fixes: 0437c8e3b198 ("Remove support for FDDI networks.")
Reviewed-by: emaste
Signed-off-by: Denny Page <dennypage at me.com>
Pull-request: https://github.com/freebsd/freebsd-src/pull/1166
(cherry picked from commit fcdf9a19893b9b5beb7a21407de507f0ae4c500b)
(cherry picked from commit d776dd5fbd484acdf00f6df55583e9aa53226859)
DeltaFile
+4-0sys/netinet/if_ether.c
+1-1sys/net/if_arp.h
+5-12 files

HardenedBSD/src d776dd5sys/net if_arp.h, sys/netinet if_ether.c

Support ARP for 802 networks

This is used by 802.3 Ethernet.  (Also be used by 802.4 Token Bus and
802.5 Token Ring, but we don't support those.)

This was accidentally removed along with FDDI support in commit
0437c8e3b198, presumably because comments implied it was used only by
FDDI or Token Ring.

Fixes: 0437c8e3b198 ("Remove support for FDDI networks.")
Reviewed-by: emaste
Signed-off-by: Denny Page <dennypage at me.com>
Pull-request: https://github.com/freebsd/freebsd-src/pull/1166
(cherry picked from commit fcdf9a19893b9b5beb7a21407de507f0ae4c500b)
DeltaFile
+4-0sys/netinet/if_ether.c
+1-1sys/net/if_arp.h
+5-12 files

HardenedBSD/src 8c81694sys/compat/linux linux_socket.c

linux: ignore setsockopt(IPV6_RECVERR)

Under Linux, the socket options IP_RECVERR and IPV6_RECVERR are used to
receive socket errors via a dedicated 'error queue' which can be
retrieved via recvmsg().  FreeBSD does not support this functionality.

For IPv4, the sysctl compat.linux.ignore_ip_recverr can be set to 1 to
silently ignore attempts to set IP_RECVERR and return success to the
application, which is wrong, but is required for (among other things)
a functional DNS client in recent versions of glibc.

Add support for ignoring IPV6_RECVERR, controlled by the same sysctl.
This fixes DNS in Linux when using IPv6 resolvers.

Reviewed by: imp, Jose Luis Duran
Pull Request: https://github.com/freebsd/freebsd-src/pull/1118

(cherry picked from commit ca63710d3668cf6f3cb4faf065d8b4eeffa028ad)
DeltaFile
+13-0sys/compat/linux/linux_socket.c
+13-01 files

HardenedBSD/src 36be765sys/dev/sound/pci hdspe.c hdspe.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+2-1sys/dev/sound/pci/hdspe.c
+1-0sys/dev/sound/pci/hdspe.h
+3-12 files

HardenedBSD/src 2ca5010contrib/less ch.c

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+2-11contrib/less/ch.c
+2-111 files