Build date: 1788127203 - Sun Aug 30 22:00:03 UTC 2026
Build cvs date: 1788117017 - Sun Aug 30 19:10:17 UTC 2026
Build id: 2026-08-31.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P bin/stty/stty.c
P lib/libcrypto/crypto.h
P lib/libcrypto/crypto_ex_data.c
P lib/libcrypto/crypto_init.c
P lib/libcrypto/crypto_internal.h
P lib/libcrypto/man/CRYPTO_set_ex_data.3
P lib/libcrypto/man/OPENSSL_init_crypto.3
P lib/libcrypto/objects/obj_mac.num
P lib/libcrypto/pkcs7/pk7_lib.c
P lib/libsndio/mio.c
P lib/libsndio/sndio.7
P lib/libssl/d1_lib.c
P regress/lib/libcrypto/dsa/dsatest.c
P regress/lib/libcrypto/ec/ectest.c
P regress/lib/libcrypto/ecdsa/ecdsatest.c
P regress/lib/libcrypto/evp/evptest.c
P regress/lib/libcrypto/exdata/exdata_test.c
P regress/lib/libcrypto/pbkdf2/pbkdf2.c
P regress/lib/libcrypto/pkcs7/pkcs7test.c
P regress/lib/libssl/ssl/ssltest.c
P sbin/ifconfig/brconfig.c
P sbin/pfctl/pfctl.c
P share/man/man5/port-modules.5
M sys/dev/usb/uhidev.c
P sys/dev/wscons/wsemul_sun.c
P sys/dev/wscons/wsemul_vt100.c
P sys/dev/wscons/wsemul_vt100var.h
P sys/kern/exec_elf.c
P sys/kern/exec_script.c
P sys/kern/kern_exec.c
P sys/kern/kern_pledge.c
P sys/net/if_veb.c
P sys/sys/exec.h
P sys/sys/exec_elf.h
P usr.bin/htpasswd/htpasswd.c
P usr.bin/mandoc/cgi.c
P usr.bin/mg/word.c
P usr.bin/openssl/openssl.c
P usr.bin/sndioctl/sndioctl.c
P usr.bin/sndiod/siofile.c
P usr.bin/sndiod/sndiod.8
P usr.bin/sndiod/sndiod.c
P usr.bin/sndiod/sock.c
M usr.sbin/bgpd/session.c
P usr.sbin/ospfctl/ospfctl.c
P usr.sbin/smtpd/lka_filter.c
P usr.sbin/snmpd/application.c
P usr.sbin/snmpd/ax.c

commit 9T3DHA2Tc7ls7Lx0
Author: kirill
Date: 2026/08/30 19:10:17

  sys: avoid script pathname TOCTOU in exec

  A readable script pathname is read twice during exec: namei() copies the
  user string for vnode lookup, while exec_script_makecmds() later copies
  the same user address into the synthetic interpreter argument list. The
  preceding single_thread_set() excludes sibling threads from this window;
  a separate process sharing writable MAP_SHARED memory remains able to
  modify the pathname between reads.

  The failing sequence is:

  1. Setup: a process stores pathname A in writable MAP_SHARED memory and
  calls fork(); the parent and child retain mappings of the same VM
  object.
  2. Check: the parent calls execve(2); namei() copies pathname A and
  resolves vnode A, after which check_exec() verifies execution access
  and reads the script header.
  3. Mutation: after namei() copies A but before the script handler
  rereads the user address, the child stores pathname B through its
  shared mapping.
  4. Use: exec_script_makecmds() calls copyinstr() on the original user
  address, obtains pathname B, and places it in the synthetic argument
  list. This second copy creates the mismatch: the kernel retains vnode
  A while the interpreter argument names B.
  5. Effect: the interpreter opens pathname B; the kernel validated vnode
  A, but the interpreter reads and executes contents selected by B.

  After single_thread_set() stops sibling threads, copy the pathname once
  into a bounded kernel buffer; use that snapshot for namei() and the
  synthetic script argument, then release it when check_exec() returns.
  This retains EFAULT and ENAMETOOLONG results while removing the second
  userspace access.

  OK: deraadt@, kettenis@

  sys/kern/exec_script.c
  sys/kern/kern_exec.c
  sys/sys/exec.h

commit 7EYthF9wU8nk7U4r
Author: tb
Date: 2026/08/30 16:56:45

  PKCS7_stream: avoid out of bounds access

  The inner content of SignedData is represented by a PKCS7 object, which
  PKCS7_stream() assumes to be a plain data object and will thus access its
  content via an ASN1_OCTET_STRING. This need not be the case after parsing.
  In fact, the inner content type is essentially arbitrary.

  If the inner content isn't one of the explicitly supported content types,
  the fallback (via p7default_tt) will populate the union's d.other with an
  ASN1_ANY which unravels to ASN1_TYPE_new() deep in the guts of tasn_dec,
  allocating a 16-byte object on LP64 architectures. In that case, the
  16-byte object is interpreted as an 24-byte ASN1_OCTET_STRING and if it
  isn't NULL, the read+write to os->flags (a long at offset 16) is out of
  bounds: os->flags | ASN1_STRING_FLAG_NDEF;

  Add a check that the content is actually id-data before accessing the
  d.data union member.

  From Acts1631

  lib/libcrypto/pkcs7/pk7_lib.c

commit QdLFzrOsqmzXf6Vq
Author: tb
Date: 2026/08/30 16:55:41

  Add test case causing an OOB access in PKCS7_stream

  Test case originally from openssl/openssl#31681, exercised via a direct
  call to PKCS7_stream() as in a report from Acts1631.
  To be fixed in pk7_lib.c r1.33

  regress/lib/libcrypto/pkcs7/pkcs7test.c

commit CX6O7eHHpxriMC54
Author: tb
Date: 2026/08/30 16:52:56

  PKCS7_stream: don't crash on omitted content

  Do not access the PKCS7 content union without checking that it's actually
  populated. Add NULL checks and fail. Whether that's the correct thing
  to do is dubious, but since this has been broken since the "code" was
  written a quarter century ago, clearly nobody ever wanted to do that.
  Match OpenSSL behavior which also means more NULL checks than strictly
  make sense.

  CMS_stream() has very similar code, but it's not problematic in this
  particular way because the content isn't OPTIONAL.

  Part of a diff from Acts1631

  lib/libcrypto/pkcs7/pk7_lib.c

commit fl9oTSz1kN85jbcs
Author: tb
Date: 2026/08/30 16:52:07

  "Stream" valid PKCS7 objects with omitted content

  The PKCS#7 standard marks the content element of the ContentInfo OPTIONAL.
  Accordingly, a PKCS#7 object only containing a Content Type OID is valid:

  SEQUENCE {
  OBJECT_IDENTIFIER { 1.2.840.113549.1.7.4 }
  }

  Deserializing such an object works and therefore streaming should at least
  have the decency of not segfaulting. Of course there's nothing decent about
  PKCS#7 be it the standard or its OpenSSL "implementation".

  Exercises a problem reported by Acts1361 and currently crashes.
  To be fixed in pk7_lib.c r1.32.

  regress/lib/libcrypto/pkcs7/pkcs7test.c

commit G2RmDFktufHnix1V
Author: tb
Date: 2026/08/30 16:39:48

  NID_communityDefinition, not NID_id_ad_communityDefinition

  lib/libcrypto/objects/obj_mac.num

commit GsDoqqRM0RGUPBr0
Author: deraadt
Date: 2026/08/30 16:14:33

  mention that specific files opened by __pledge_open() are only opened
  by specific libc functions (with symbol visibility helping us). these fd
  are marked UF_PLEDGEOPEN, and the kernel prohibits various operations
  on them (basically we are trying to prevent threads from playing with them)

  sys/kern/kern_pledge.c

commit XacLq9YVQIFzy9JM
Author: stu
Date: 2026/08/30 15:53:56

  New variables for Tcl 8/9 ports.

  ok sthen@

  share/man/man5/port-modules.5

commit PRfIWkPGygNmW3Y8
Author: ratchov
Date: 2026/08/30 14:56:39

  sndioctl: Use everywhere the same type (unsigned int) to store the mode

  usr.bin/sndioctl/sndioctl.c

commit htCFRr17EtDN2pGV
Author: ratchov
Date: 2026/08/30 14:35:40

  sndiod: Drop dead-code and slightly simplify dev_sio_open()

  usr.bin/sndiod/siofile.c

commit Jc6orqM2P8q4yGxv
Author: deraadt
Date: 2026/08/30 14:23:39

  In execve(2), attempt to create a realpath buffer for the executable
  and place the resulting string on the stack as an auxval.  The two
  main reasons why the attempt can fail are if the program is started
  inside an unlinked directory or if the buffer exceeds PATH_MAX.  libc
  will be able to find this auxval and provide it in an uncoming
  getexecpath(3) API.
  ok kettenis beck kirill

  sys/kern/exec_elf.c
  sys/kern/exec_script.c
  sys/kern/kern_exec.c
  sys/sys/exec.h
  sys/sys/exec_elf.h

commit ltU54sOhHv5fEh4y
Author: ratchov
Date: 2026/08/30 13:49:19

  sndiod: Make sure MODE_{PLAY,REC} aren't used on a MIDI port

  usr.bin/sndiod/sock.c

commit IJw2ff4zSdglQLZq
Author: ajacoutot
Date: 2026/08/30 13:45:11

  Document cargo builds with the devel/meson MODULE.

  thanks schwarze@ for the mandoc fixes.

  share/man/man5/port-modules.5

commit XaT7i02bjlHIKK4y
Author: schwarze
Date: 2026/08/30 13:13:12

  Further improve error handling, in particular
  provide a non-zero EXIT STATUS in some error cases
  and properly close HTML output after open(2) failure.

  usr.bin/mandoc/cgi.c

commit HAksiXTauIQwup6y
Author: jsg
Date: 2026/08/30 12:39:08

  Unkown -> Unknown

  usr.sbin/snmpd/ax.c

commit RX2ho7L7fR7Fdc7U
Author: jsg
Date: 2026/08/30 12:37:10

  unregiser -> unregister

  usr.sbin/snmpd/application.c

commit kV1JJh1h2myPXg93
Author: jsg
Date: 2026/08/30 12:35:16

  reponse -> response

  usr.sbin/smtpd/lka_filter.c

commit MY7DubrZeWOvhNkh
Author: jsg
Date: 2026/08/30 12:33:15

  faied -> failed

  usr.sbin/ospfctl/ospfctl.c

commit hGcFI2UzJoM4860F
Author: jsg
Date: 2026/08/30 12:31:46

  tranpose -> transpose

  usr.bin/mg/word.c

commit 88pnWLr32lEXmWXL
Author: jsg
Date: 2026/08/30 12:29:37

  bcryt -> bcrypt

  usr.bin/htpasswd/htpasswd.c

commit RIwq3gmtmn4zfM7y
Author: jsg
Date: 2026/08/30 12:27:27

  ambigious -> ambiguous

  sbin/pfctl/pfctl.c

commit 99071WAE6QIDWynB
Author: kenjiro
Date: 2026/08/30 12:23:16

  libssl: avoid narrowing return value in dtls1_ctrl

  dtls1_ctrl() and ssl3_ctrl() return long, but the intermediate return
  value was stored in an int. Use long to avoid truncating values returned
  by ssl3_ctrl().

  CID 497395

  From Yuji Hashimoto

  ok tb jsing

  lib/libssl/d1_lib.c

commit duJIUU2SVp20WoeI
Author: kenjiro
Date: 2026/08/30 12:19:37

  Make CRYPTO_cleanup_all_ex_data() a compatibility no-op

  The ex_data callback registry is process-wide, but this API could free
  it while other threads were still using libcrypto, resulting in a
  use-after-free.

  Retain the public symbol as a compatibility no-op and mark it
  deprecated. Move the actual cleanup to an internal function called by
  OPENSSL_cleanup(). Replace the in-tree callers with OPENSSL_cleanup()
  at final shutdown to preserve cleanup behavior and coverage.

  Document both APIs and the requirement that OPENSSL_cleanup() only be
  called after all threads and components have stopped using libcrypto.

  ok tb

  lib/libcrypto/crypto.h
  lib/libcrypto/crypto_ex_data.c
  lib/libcrypto/crypto_init.c
  lib/libcrypto/crypto_internal.h
  lib/libcrypto/man/CRYPTO_set_ex_data.3
  lib/libcrypto/man/OPENSSL_init_crypto.3
  regress/lib/libcrypto/dsa/dsatest.c
  regress/lib/libcrypto/ec/ectest.c
  regress/lib/libcrypto/ecdsa/ecdsatest.c
  regress/lib/libcrypto/evp/evptest.c
  regress/lib/libcrypto/exdata/exdata_test.c
  regress/lib/libcrypto/pbkdf2/pbkdf2.c
  regress/lib/libssl/ssl/ssltest.c
  usr.bin/openssl/openssl.c

commit YtiaUvQqdQg9AoRv
Author: schwarze
Date: 2026/08/30 10:47:23

  Delay starting HTML output until we are sure that we have some data
  to offer to the user, either from a manual page file that can actually
  be opened or at least a list of links to pages matching the user's query.

  When no information whatsoever can be accessed, always return
  HTTP 400 Bad Request (e.g. for an unsupported, nonexistent, or unreadable
  path or an invalid architecture) or HTTP 500 Internal Server Error (e.g.
  for a system call failure, an inaccessible or invalid configuration file,
  an inaccessible directory, or a corrupt database).

  This also prepares for pledge(2)/unveil(2) improvements by making it
  possible to invoke these system calls after open(2)ing the chosen
  manual page file.

  usr.bin/mandoc/cgi.c

commit OFFzzjCycU8rFkKw
Author: miod
Date: 2026/08/30 06:44:10

  Clamp numeric arguments of terminal escape sequences to an arbitrary value of
  100,000. The existing logic would happily process as many digits as provided,
  which could make the values wraparound at 2**32, or be considered as negative
  values if cast to a signed type, leading to incorrect processing.

  Bug report by Acts1631.

  sys/dev/wscons/wsemul_sun.c
  sys/dev/wscons/wsemul_vt100.c
  sys/dev/wscons/wsemul_vt100var.h

commit KFwAPfUOnHR7kNhW
Author: dlg
Date: 2026/08/30 06:29:41

  whitespace fixes, no functional change

  sbin/ifconfig/brconfig.c

commit mmz1UBy2DV5ArdK8
Author: dlg
Date: 2026/08/30 06:29:03

  collapse ranges of community ids when printing pvlan info.

  mostly borrowed from the code that collapses ranges of vids when
  printing the allowed vlan tags on ports.

  sbin/ifconfig/brconfig.c

commit VR82Se986Is3oph4
Author: ratchov
Date: 2026/08/30 06:21:05

  sndiod: Unify "midithru/N" and "midi/N" ports

  Add the -p option to register MIDI ports that programs can
  access as "midi/<name>". They have the same functionnality as the
  current "midithru/<number>" ports. The default MIDI port becomes
  simply "midi/default", which is automatically created (similarly
  to the default audio device).

  The "midithru/<number>" syntax is still accepted for backwards
  compatibility.

  lib/libsndio/mio.c
  lib/libsndio/sndio.7
  usr.bin/sndiod/sndiod.8
  usr.bin/sndiod/sndiod.c
  usr.bin/sndiod/sock.c

commit OjNSFZcB2OqYXIDU
Author: dlg
Date: 2026/08/30 05:38:26

  cope with the port map being NULL in veb_vid_inuse.

  avoids a null deref when configuring pvlans before ports on a veb.

  sys/net/if_veb.c

commit WZiZyLsOTjP7Adj5
Author: deraadt
Date: 2026/08/30 02:31:53

  use TCSANOW (which is 0) for the 2nd parameter of tcsetattr instead of 0

  bin/stty/stty.c