Fix named(8) DNSSEC validation Denial of Service.

Security:	FreeBSD-SA-12:05.bind
Security:	CVE-2012-3817
Obtained from:	ISC
Approved by:	so (simon)

Makefile.inc1

@@ -93,7 +93,7 @@ CLEANDIR=	cleandir
 .endif
 
 CVS?=		cvs
-CVSFLAGS?=	-r RELENG_8 -P -d -I!
+CVSFLAGS?=	-r RELENG_8_1 -P -d -I!
 SVN?=		svn
 SVNFLAGS?=	-r HEAD
 SUP?=		/usr/bin/csup

UPDATING

@@ -15,6 +15,83 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8.x IS SLOW ON IA64 OR SUN4V:
 	debugging tools present in HEAD were left in place because
 	sun4v support still needs work to become production ready.
 
+
+20120806:	p13	FreeBSD-SA-12:05.bind
+	Fix named(8) DNSSEC validation Denial of Service.
+
+20120618:	p12	FreeBSD-SA-12:04.sysret
+	Correct patch for FreeBSD-SA-12:04.sysret.
+
+20120612:	p11	FreeBSD-SA-12:03.bind
+			FreeBSD-SA-12:04.sysret
+			FreeBSD-EN-12:02.ipv6refcount
+	Fix a problem where zero-length RDATA fields can cause named to crash.
+	[12:03]
+
+	Correct a privilege escalation when returning from kernel if
+	running FreeBSD/amd64 on non-AMD processors. [12:04]
+
+	Fix reference count errors in IPv6 code. [EN-12:02]
+
+20120530:	p10	FreeBSD-SA-12:01.openssl (revised),
+			FreeBSD-SA-12:02.crypt
+	Update the previous openssl fix. [12:01]
+
+	Fix a bug in crypt(3) ignoring characters of a passphrase. [12:02]
+
+20120503:	p9	FreeBSD-SA-12:01.openssl
+	Fix multiple OpenSSL vulnerabilities.
+
+20120104:	p8	FreeBSD-EN-12:01.freebsd-update
+	Extend the character set accepted by freebsd-update(8) in file
+	names in order to allow upgrades to FreeBSD 9.0-RELEASE.
+
+20111223:	p7	FreeBSD-SA-11:06.bind, FreeBSD-SA-11:07.chroot
+			FreeBSD-SA-11:08.telnetd, FreeBSD-SA-11:09.pam_ssh
+			FreeBSD-SA-11:10.pam
+	Fix a problem whereby a corrupt DNS record can cause named to crash.
+	[11:06]
+
+	Add an API for alerting internal libc routines to the presence of
+	"unsafe" paths post-chroot, and use it in ftpd. [11:07]
+
+	Fix a buffer overflow in telnetd. [11:08]
+
+	Make pam_ssh ignore unpassphrased keys unless the "nullok" option is
+	specified. [11:09]
+
+	Add sanity checking of service names in pam_start. [11:10]
+
+20111004:	p6	FreeBSD-SA-11:05.unix (revised)
+	Fix a bug in UNIX socket handling in the linux emulator which was
+	exposed by the security fix in FreeBSD-SA-11:05.unix.
+
+20110928:	p5	FreeBSD-SA-11:04.compress, FreeBSD-SA-11:05.unix
+	Fix handling of corrupt compress(1)ed data. [11:04]
+
+	Add missing length checks on unix socket addresses. [11:05]
+
+20110528:	p4	FreeBSD-SA-11:02.bind
+	Fix BIND remote DoS with large RRSIG RRsets and negative
+	caching.
+
+20110420:	p3	FreeBSD-SA-11:01.mountd
+	Fix CIDR parsing bug in mountd ACLs.
+
+20101129:	p2	FreeBSD-SA-10:10.openssl
+	Fix OpenSSL multiple vulnerabilities.
+
+20100920:	p1	FreeBSD-SA-10:08.bzip2
+	Fix an integer overflow in RLE length parsing when decompressing
+	corrupt bzip2 data.
+
+20100720:
+	8.1-RELEASE.
+
+20100713:		FreeBSD-SA-10:07.mbuf
+	Correctly copy the M_RDONLY flag when duplicating a reference
+	to an mbuf external buffer.
+
 20100502:
 	The config(8) command has been updated to maintain compatibility
 	with config files from 8.0-RELEASE.  You will need a new version
@@ -56,6 +133,9 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8.x IS SLOW ON IA64 OR SUN4V:
 	via the DEADLKRES option, see NOTES for more details) and the
 	sleepq_type() function for sleepqueues.
 
+20091125:
+	8.0-RELEASE.
+
 20090929:
 	802.11s D3.03 support was committed. This is incompatible with
 	the previous code, which was based on D3.0.

contrib/bind9/bin/named/query.c

@@ -1282,11 +1282,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			/*
-			 * Negative cache entries don't have sigrdatasets.
-			 */
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1327,8 +1325,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1777,10 +1776,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		goto setcache;
 	if (result == DNS_R_NCACHENXRRSET) {
 		dns_rdataset_disassociate(rdataset);
-		/*
-		 * Negative cache entries don't have sigrdatasets.
-		 */
-		INSIST(! dns_rdataset_isassociated(sigrdataset));
+		if (dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
 	}
 	if (result == ISC_R_SUCCESS) {
 		/* Remember the result as a cache */

contrib/bind9/lib/dns/ncache.c

@@ -185,7 +185,7 @@ dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
 					 */
 					isc_buffer_availableregion(&buffer,
 								   &r);
-					if (r.length < 2)
+					if (r.length < 3)
 						return (ISC_R_NOSPACE);
 					isc_buffer_putuint16(&buffer,
 							     rdataset->type);

contrib/bind9/lib/dns/rbtdb.c

@@ -278,6 +278,7 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
 #define RDATASET_ATTR_RESIGN            0x0020
 #define RDATASET_ATTR_STATCOUNT         0x0040
 #define RDATASET_ATTR_OPTOUT		0x0080
+#define RDATASET_ATTR_NEGATIVE		0x0100
 
 typedef struct acache_cbarg {
 	dns_rdatasetadditional_t        type;
@@ -316,6 +317,8 @@ struct acachectl {
 	(((header)->attributes & RDATASET_ATTR_RESIGN) != 0)
 #define OPTOUT(header) \
 	(((header)->attributes & RDATASET_ATTR_OPTOUT) != 0)
+#define NEGATIVE(header) \
+	(((header)->attributes & RDATASET_ATTR_NEGATIVE) != 0)
 
 #define DEFAULT_NODE_LOCK_COUNT         7       /*%< Should be prime. */
 
@@ -4618,7 +4621,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 			      rdataset);
 		if (need_headerupdate(found, search.now))
 			update = found;
-		if (foundsig != NULL) {
+		if (!NEGATIVE(found) && foundsig != NULL) {
 			bind_rdataset(search.rbtdb, node, foundsig, search.now,
 				      sigrdataset);
 			if (need_headerupdate(foundsig, search.now))
@@ -5245,7 +5248,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	}
 	if (found != NULL) {
 		bind_rdataset(rbtdb, rbtnode, found, now, rdataset);
-		if (foundsig != NULL)
+		if (!NEGATIVE(found) && foundsig != NULL)
 			bind_rdataset(rbtdb, rbtnode, foundsig, now,
 				      sigrdataset);
 	}

contrib/bind9/lib/dns/rdata.c

@@ -341,8 +341,8 @@ dns_rdata_compare(const dns_rdata_t *rdata1, const dns_rdata_t *rdata2) {
 
 	REQUIRE(rdata1 != NULL);
 	REQUIRE(rdata2 != NULL);
-	REQUIRE(rdata1->data != NULL);
-	REQUIRE(rdata2->data != NULL);
+	REQUIRE(rdata1->length == 0 || rdata1->data != NULL);
+	REQUIRE(rdata2->length == 0 || rdata2->data != NULL);
 	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata1));
 	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata2));
 

contrib/bind9/lib/dns/rdataslab.c

@@ -125,6 +125,11 @@ isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen)
 {
+	/*
+	 * Use &removed as a sentinal pointer for duplicate
+	 * rdata as rdata.data == NULL is valid.
+	 */
+	static unsigned char removed;
 	struct xrdata  *x;
 	unsigned char  *rawbuf;
 #if DNS_RDATASET_FIXED
@@ -164,6 +169,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		INSIST(result == ISC_R_SUCCESS);
 		dns_rdata_init(&x[i].rdata);
 		dns_rdataset_current(rdataset, &x[i].rdata);
+		INSIST(x[i].rdata.data != &removed);
 #if DNS_RDATASET_FIXED
 		x[i].order = i;
 #endif
@@ -196,8 +202,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 */
 	for (i = 1; i < nalloc; i++) {
 		if (compare_rdata(&x[i-1].rdata, &x[i].rdata) == 0) {
-			x[i-1].rdata.data = NULL;
-			x[i-1].rdata.length = 0;
+			x[i-1].rdata.data = &removed;
 #if DNS_RDATASET_FIXED
 			/*
 			 * Preserve the least order so A, B, A -> A, B
@@ -284,7 +289,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 #endif
 
 	for (i = 0; i < nalloc; i++) {
-		if (x[i].rdata.data == NULL)
+		if (x[i].rdata.data == &removed)
 			continue;
 #if DNS_RDATASET_FIXED
 		offsettable[x[i].order] = rawbuf - offsetbase;

contrib/bind9/lib/dns/resolver.c

@@ -7929,6 +7929,7 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
 		}
 		bad->type = type;
 		bad->hashval = hashval;
+		bad->expire = *expire;
 		isc_buffer_init(&buffer, bad + 1, name->length);
 		dns_name_init(&bad->name, NULL);
 		dns_name_copy(name, &bad->name, &buffer);
@@ -7940,8 +7941,8 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
 		if (resolver->badcount < resolver->badhash * 2 &&
 		    resolver->badhash > DNS_BADCACHE_SIZE)
 			resizehash(resolver, &now, ISC_FALSE);
-	}
-	bad->expire = *expire;
+	} else
+		bad->expire = *expire;
  cleanup:
 	UNLOCK(&resolver->lock);
 }

contrib/bzip2/decompress.c

@@ -381,6 +381,13 @@ Int32 BZ2_decompress ( DState* s )
             es = -1;
             N = 1;
             do {
+               /* Check that N doesn't get too big, so that es doesn't
+                  go negative.  The maximum value that can be
+                  RUNA/RUNB encoded is equal to the block size (post
+                  the initial RLE), viz, 900k, so bounding N at 2
+                  million should guard against overflow without
+                  rejecting any legitimate inputs. */
+               if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
                if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
                if (nextSym == BZ_RUNB) es = es + (1+1) * N;
                N = N * 2;

contrib/openpam/lib/openpam_configure.c

@@ -285,6 +285,13 @@ openpam_load_chain(pam_handle_t *pamh,
 	size_t len;
 	int r;
 
+	/* don't allow to escape from policy_path */
+	if (strchr(service, '/')) {
+		openpam_log(PAM_LOG_ERROR, "invalid service name: %s",
+		    service);
+		return (-PAM_SYSTEM_ERR);
+	}
+
 	for (path = openpam_policy_path; *path != NULL; ++path) {
 		len = strlen(*path);
 		if ((*path)[len - 1] == '/') {

contrib/telnet/libtelnet/encrypt.c

@@ -721,6 +721,9 @@ encrypt_keyid(struct key_info *kp, unsigned char *keyid, int len)
 	int dir = kp->dir;
 	int ret = 0;
 
+	if (len > MAXKEYLEN)
+		len = MAXKEYLEN;
+
 	if (!(ep = (*kp->getcrypt)(*kp->modep))) {
 		if (len == 0)
 			return;

crypto/heimdal/appl/telnet/libtelnet/encrypt.c

@@ -736,6 +736,9 @@ encrypt_keyid(struct key_info *kp, unsigned char *keyid, int len)
     int dir = kp->dir;
     int ret = 0;
 
+    if (len > MAXKEYLEN)
+        len = MAXKEYLEN;
+
     if (!(ep = (*kp->getcrypt)(*kp->modep))) {
 	if (len == 0)
 	    return;

crypto/openssl/crypto/asn1/a_d2i_fp.c

@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 #include <openssl/asn1_mac.h>
@@ -143,17 +144,11 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 	BUF_MEM *b;
 	unsigned char *p;
 	int i;
-	int ret=-1;
 	ASN1_const_CTX c;
-	int want=HEADER_SIZE;
+	size_t want=HEADER_SIZE;
 	int eos=0;
-#if defined(__GNUC__) && defined(__ia64)
-	/* pathetic compiler bug in all known versions as of Nov. 2002 */
-	long off=0;
-#else
-	int off=0;
-#endif
-	int len=0;
+	size_t off=0;
+	size_t len=0;
 
 	b=BUF_MEM_new();
 	if (b == NULL)
@@ -169,7 +164,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 			{
 			want-=(len-off);
 
-			if (!BUF_MEM_grow_clean(b,len+want))
+			if (len + want < len || !BUF_MEM_grow_clean(b,len+want))
 				{
 				ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);
 				goto err;
@@ -181,7 +176,14 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 				goto err;
 				}
 			if (i > 0)
+				{
+				if (len+i < len)
+					{
+					ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG);
+					goto err;
+					}
 				len+=i;
+				}
 			}
 		/* else data already loaded */
 
@@ -206,6 +208,11 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 			{
 			/* no data body so go round again */
 			eos++;
+			if (eos < 0)
+				{
+				ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_HEADER_TOO_LONG);
+				goto err;
+				}
 			want=HEADER_SIZE;
 			}
 		else if (eos && (c.slen == 0) && (c.tag == V_ASN1_EOC))
@@ -220,10 +227,16 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 		else 
 			{
 			/* suck in c.slen bytes of data */
-			want=(int)c.slen;
+			want=c.slen;
 			if (want > (len-off))
 				{
 				want-=(len-off);
+				if (want > INT_MAX /* BIO_read takes an int length */ ||
+					len+want < len)
+						{
+						ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG);
+						goto err;
+						}
 				if (!BUF_MEM_grow_clean(b,len+want))
 					{
 					ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);
@@ -238,11 +251,18 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 						    ASN1_R_NOT_ENOUGH_DATA);
 						goto err;
 						}
+					/* This can't overflow because
+					 * |len+want| didn't overflow. */
 					len+=i;
-					want -= i;
+					want-=i;
 					}
 				}
-			off+=(int)c.slen;
+			if (off + c.slen < off)
+				{
+				ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG);
+				goto err;
+				}
+			off+=c.slen;
 			if (eos <= 0)
 				{
 				break;
@@ -252,9 +272,15 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 			}
 		}
 
+	if (off > INT_MAX)
+		{
+		ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_TOO_LONG);
+		goto err;
+		}
+
 	*pb = b;
 	return off;
 err:
 	if (b != NULL) BUF_MEM_free(b);
-	return(ret);
+	return -1;
 	}

crypto/openssl/crypto/buffer/buffer.c

@@ -60,6 +60,11 @@
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 
+/* LIMIT_BEFORE_EXPANSION is the maximum n such that (n+3)/3*4 < 2**31. That
+ * function is applied in several functions in this file and this limit ensures
+ * that the result fits in an int. */
+#define LIMIT_BEFORE_EXPANSION 0x5ffffffc
+
 BUF_MEM *BUF_MEM_new(void)
 	{
 	BUF_MEM *ret;
@@ -94,6 +99,11 @@ int BUF_MEM_grow(BUF_MEM *str, int len)
 	char *ret;
 	unsigned int n;
 
+	if (len < 0)
+		{
+		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
 	if (str->length >= len)
 		{
 		str->length=len;
@@ -105,6 +115,12 @@ int BUF_MEM_grow(BUF_MEM *str, int len)
 		str->length=len;
 		return(len);
 		}
+	/* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */
+	if (len > LIMIT_BEFORE_EXPANSION)
+		{
+		BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
 	n=(len+3)/3*4;
 	if (str->data == NULL)
 		ret=OPENSSL_malloc(n);
@@ -130,6 +146,11 @@ int BUF_MEM_grow_clean(BUF_MEM *str, int len)
 	char *ret;
 	unsigned int n;
 
+	if (len < 0)
+		{
+		BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
 	if (str->length >= len)
 		{
 		memset(&str->data[len],0,str->length-len);
@@ -142,6 +163,12 @@ int BUF_MEM_grow_clean(BUF_MEM *str, int len)
 		str->length=len;
 		return(len);
 		}
+	/* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */
+	if (len > LIMIT_BEFORE_EXPANSION)
+		{
+		BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
 	n=(len+3)/3*4;
 	if (str->data == NULL)
 		ret=OPENSSL_malloc(n);

crypto/openssl/crypto/mem.c

@@ -372,6 +372,10 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,
 
 	if (num <= 0) return NULL;
 
+	/* We don't support shrinking the buffer. Note the memcpy that copies
+	 * |old_len| bytes to the new buffer, below. */
+	if (num < old_len) return NULL;
+
 	if (realloc_debug_func != NULL)
 		realloc_debug_func(str, NULL, num, file, line, 0);
 	ret=malloc_ex_func(num,file,line);

crypto/openssl/crypto/pkcs7/pk7_doit.c

@@ -423,6 +423,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 		int max;
 		X509_OBJECT ret;
 #endif
+		unsigned char *tkey = NULL;
+		int tkeylen;
 		int jj;
 
 		if ((etmp=BIO_new(BIO_f_cipher())) == NULL)
@@ -464,36 +466,42 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 
 		if (pcert == NULL)
 			{
+			/* Temporary storage in case EVP_PKEY_decrypt
+			 * overwrites output buffer on error.
+			 */
+			unsigned char *tmp2;
+			tmp2 = OPENSSL_malloc(jj);
+			if (!tmp2)
+				goto err;
+			jj = -1;
+			/* Always attempt to decrypt all cases to avoid
+			 * leaking timing information about a successful
+			 * decrypt.
+			 */
 			for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
 				{
+				int tret;
 				ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
-				jj=EVP_PKEY_decrypt(tmp,
+				tret=EVP_PKEY_decrypt(tmp2,
 					M_ASN1_STRING_data(ri->enc_key),
 					M_ASN1_STRING_length(ri->enc_key),
 						pkey);
-				if (jj > 0)
-					break;
+				if (tret > 0)
+					{
+					memcpy(tmp, tmp2, tret);
+					OPENSSL_cleanse(tmp2, tret);
+					jj = tret;
+					}
 				ERR_clear_error();
-				ri = NULL;
-				}
-			if (ri == NULL)
-				{
-				PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-				      PKCS7_R_NO_RECIPIENT_MATCHES_KEY);
-				goto err;
 				}
+			OPENSSL_free(tmp2);
 			}
 		else
 			{
 			jj=EVP_PKEY_decrypt(tmp,
 				M_ASN1_STRING_data(ri->enc_key),
 				M_ASN1_STRING_length(ri->enc_key), pkey);
-			if (jj <= 0)
-				{
-				PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-								ERR_R_EVP_LIB);
-				goto err;
-				}
+			ERR_clear_error();
 			}
 
 		evp_ctx=NULL;
@@ -502,24 +510,49 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 			goto err;
 		if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
 			goto err;
+		/* Generate random key to counter MMA */
+		tkeylen = EVP_CIPHER_CTX_key_length(evp_ctx);
+		tkey = OPENSSL_malloc(tkeylen);
+		if (!tkey)
+			goto err;
+		if (EVP_CIPHER_CTX_rand_key(evp_ctx, tkey) <= 0)
+			goto err;
+		/* If we have no key use random key */
+		if (jj <= 0)
+			{
+			OPENSSL_free(tmp);
+			jj = tkeylen;
+			tmp = tkey;
+			tkey = NULL;
+			}
 
-		if (jj != EVP_CIPHER_CTX_key_length(evp_ctx)) {
+		if (jj != tkeylen) {
 			/* Some S/MIME clients don't use the same key
 			 * and effective key length. The key length is
 			 * determined by the size of the decrypted RSA key.
 			 */
 			if(!EVP_CIPHER_CTX_set_key_length(evp_ctx, jj))
 				{
-				PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-					PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
-				goto err;
+				/* As MMA defence use random key instead */
+				OPENSSL_cleanse(tmp, jj);
+				OPENSSL_free(tmp);
+				jj = tkeylen;
+				tmp = tkey;
+				tkey = NULL;
 				}
 		} 
+		ERR_clear_error();
 		if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,tmp,NULL,0) <= 0)
 			goto err;
 
 		OPENSSL_cleanse(tmp,jj);
 
+		if (tkey)
+			{
+			OPENSSL_cleanse(tkey, tkeylen);
+			OPENSSL_free(tkey);
+			}
+
 		if (out == NULL)
 			out=etmp;
 		else

crypto/openssl/crypto/x509v3/pcy_map.c

@@ -70,8 +70,6 @@ static int ref_cmp(const X509_POLICY_REF * const *a,
 
 static void policy_map_free(X509_POLICY_REF *map)
 	{
-	if (map->subjectDomainPolicy)
-		ASN1_OBJECT_free(map->subjectDomainPolicy);
 	OPENSSL_free(map);
 	}
 
@@ -95,6 +93,7 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
 	{
 	POLICY_MAPPING *map;
 	X509_POLICY_REF *ref = NULL;
+	ASN1_OBJECT *subjectDomainPolicyRef;
 	X509_POLICY_DATA *data;
 	X509_POLICY_CACHE *cache = x->policy_cache;
 	int i;
@@ -153,13 +152,16 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
 		if (!sk_ASN1_OBJECT_push(data->expected_policy_set, 
 						map->subjectDomainPolicy))
 			goto bad_mapping;
+                /* map->subjectDomainPolicy will be freed when
+                 * cache->data is freed. Set it to NULL to avoid double-free. */
+                subjectDomainPolicyRef = map->subjectDomainPolicy;
+                map->subjectDomainPolicy = NULL;
 		
 		ref = OPENSSL_malloc(sizeof(X509_POLICY_REF));
 		if (!ref)
 			goto bad_mapping;
 
-		ref->subjectDomainPolicy = map->subjectDomainPolicy;
-		map->subjectDomainPolicy = NULL;
+		ref->subjectDomainPolicy = subjectDomainPolicyRef;
 		ref->data = data;
 
 		if (!sk_X509_POLICY_REF_push(cache->maps, ref))

crypto/openssl/crypto/x509v3/pcy_tree.c

@@ -612,6 +612,10 @@ int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
 		case 2:
 		return 1;
 
+                /* Some internal error */
+		case -1:
+		return -1;
+
 		/* Some internal error */
 		case 0:
 		return 0;
@@ -691,4 +695,3 @@ int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
 	return 0;
 
 	}
-

crypto/openssl/ssl/s3_clnt.c

@@ -1377,6 +1377,7 @@ int ssl3_get_key_exchange(SSL *s)
 		s->session->sess_cert->peer_ecdh_tmp=ecdh;
 		ecdh=NULL;
 		BN_CTX_free(bn_ctx);
+		bn_ctx = NULL;
 		EC_POINT_free(srvr_ecpoint);
 		srvr_ecpoint = NULL;
 		}

crypto/openssl/ssl/s3_enc.c

@@ -480,6 +480,9 @@ int ssl3_enc(SSL *s, int send)
 
 			/* we need to add 'i-1' padding bytes */
 			l+=i;
+			/* the last of these zero bytes will be overwritten
+			 * with the padding length. */
+			memset(&rec->input[rec->length], 0, i);
 			rec->length+=i;
 			rec->input[l-1]=(i-1);
 			}

crypto/openssl/ssl/s3_srvr.c

@@ -235,6 +235,7 @@ int ssl3_accept(SSL *s)
 				}
 
 			s->init_num=0;
+			s->s3->flags &= ~SSL3_FLAGS_SGC_RESTART_DONE;
 
 			if (s->state != SSL_ST_RENEGOTIATE)
 				{
@@ -709,6 +710,13 @@ int ssl3_check_client_hello(SSL *s)
 	s->s3->tmp.reuse_message = 1;
 	if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
 		{
+		/* We only allow the client to restart the handshake once per
+		 * negotiation. */
+		if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
+			{
+			SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
+			return -1;
+			}
 		/* Throw away what we have done so far in the current handshake,
 		 * which will now be aborted. (A full SSL_clear would be too much.)
 		 * I hope that tmp.dh is the only thing that may need to be cleared
@@ -720,6 +728,7 @@ int ssl3_check_client_hello(SSL *s)
 			s->s3->tmp.dh = NULL;
 			}
 #endif
+		s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE;
 		return 2;
 		}
 	return 1;

crypto/openssl/ssl/ssl.h

@@ -1739,6 +1739,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_CALLBACK_CTRL			 233
 #define SSL_F_SSL3_CHANGE_CIPHER_STATE			 129
 #define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM		 130
+#define SSL_F_SSL3_CHECK_CLIENT_HELLO			 292
 #define SSL_F_SSL3_CLIENT_HELLO				 131
 #define SSL_F_SSL3_CONNECT				 132
 #define SSL_F_SSL3_CTRL					 213
@@ -1974,6 +1975,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_TMP_RSA_KEY			 172
 #define SSL_R_MISSING_TMP_RSA_PKEY			 173
 #define SSL_R_MISSING_VERIFY_MESSAGE			 174
+#define SSL_R_MULTIPLE_SGC_RESTARTS			 325
 #define SSL_R_NON_SSLV2_INITIAL_PACKET			 175
 #define SSL_R_NO_CERTIFICATES_RETURNED			 176
 #define SSL_R_NO_CERTIFICATE_ASSIGNED			 177

crypto/openssl/ssl/ssl3.h

@@ -333,6 +333,17 @@ typedef struct ssl3_buffer_st
 #define SSL3_FLAGS_DELAY_CLIENT_FINISHED	0x0002
 #define SSL3_FLAGS_POP_BUFFER			0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG		0x0008
+ 
+/* SSL3_FLAGS_SGC_RESTART_DONE is set when we
+ * restart a handshake because of MS SGC and so prevents us
+ * from restarting the handshake in a loop. It's reset on a
+ * renegotiation, so effectively limits the client to one restart
+ * per negotiation. This limits the possibility of a DDoS
+ * attack where the client handshakes in a loop using SGC to
+ * restart. Servers which permit renegotiation can still be
+ * effected, but we can't prevent that.
+ */
+#define SSL3_FLAGS_SGC_RESTART_DONE		0x0040
 
 typedef struct ssl3_state_st
 	{

crypto/openssl/ssl/ssl_err.c

@@ -137,6 +137,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL),	"SSL3_CALLBACK_CTRL"},
 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE),	"SSL3_CHANGE_CIPHER_STATE"},
 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM),	"SSL3_CHECK_CERT_AND_ALGORITHM"},
+{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO),	"SSL3_CHECK_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO),	"SSL3_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CONNECT),	"SSL3_CONNECT"},
 {ERR_FUNC(SSL_F_SSL3_CTRL),	"SSL3_CTRL"},
@@ -375,6 +376,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY)   ,"missing tmp rsa key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY)  ,"missing tmp rsa pkey"},
 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"},
+{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"},
 {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"},
 {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"},
 {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"},

crypto/openssl/ssl/t1_lib.c

@@ -432,14 +432,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 				switch (servname_type)
 					{
 				case TLSEXT_NAMETYPE_host_name:
-					if (s->session->tlsext_hostname == NULL)
+					if (!s->hit)
 						{
-						if (len > TLSEXT_MAXLEN_host_name || 
-							((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
+						if(s->session->tlsext_hostname)
+							{
+							*al = SSL_AD_DECODE_ERROR;
+							return 0;
+							}
+						if (len > TLSEXT_MAXLEN_host_name)
 							{
 							*al = TLS1_AD_UNRECOGNIZED_NAME;
 							return 0;
 							}
+						if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
+							{
+							*al = TLS1_AD_INTERNAL_ERROR;
+							return 0;
+							}
 						memcpy(s->session->tlsext_hostname, sdata, len);
 						s->session->tlsext_hostname[len]='\0';
 						if (strlen(s->session->tlsext_hostname) != len) {
@@ -452,7 +461,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 
 						}
 					else 
-						s->servername_done = strlen(s->session->tlsext_hostname) == len 
+						s->servername_done = s->session->tlsext_hostname
+							&& strlen(s->session->tlsext_hostname) == len 
 							&& strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 					
 					break;

etc/namedb/named.root

@@ -13,8 +13,8 @@
 ;           on server           FTP.INTERNIC.NET
 ;       -OR-                    RS.INTERNIC.NET
 ;
-;       last update:    Dec 12, 2008
-;       related version of root zone:   2008121200
+;       last update:    Jun 17, 2010
+;       related version of root zone:   2010061700
 ;
 ; formerly NS.INTERNIC.NET
 ;
@@ -63,6 +63,7 @@ H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::803F:235
 ;
 .                        3600000      NS    I.ROOT-SERVERS.NET.
 I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7FE::53
 ;
 ; OPERATED BY VERISIGN, INC.
 ;

include/unistd.h

@@ -513,6 +513,7 @@ int	 initgroups(const char *, gid_t);
 int	 iruserok(unsigned long, int, const char *, const char *);
 int	 iruserok_sa(const void *, int, int, const char *, const char *);
 int	 issetugid(void);
+void	__FreeBSD_libc_enter_restricted_mode(void);
 long	 lpathconf(const char *, int);
 #ifndef _MKDTEMP_DECLARED
 char	*mkdtemp(char *);

lib/libc/Versions.def

@@ -19,6 +19,10 @@ FBSD_1.1 {
 FBSD_1.2 {
 } FBSD_1.1;
 
+# This version was first added to 10.0-current.
+FBSD_1.3 {
+} FBSD_1.2;
+
 # This is our private namespace.  Any global interfaces that are
 # strictly for use only by other FreeBSD applications and libraries
 # are listed here.  We use a separate namespace so we can write
@@ -26,4 +30,4 @@ FBSD_1.2 {
 #
 # Please do NOT increment the version of this namespace.
 FBSDprivate_1.0 {
-} FBSD_1.2;
+} FBSD_1.3;

lib/libc/gen/Makefile.inc

@@ -20,6 +20,7 @@ SRCS+=  __getosreldate.c __xuname.c \
 	getpeereid.c getprogname.c getpwent.c getttyent.c \
 	getusershell.c getvfsbyname.c glob.c \
 	initgroups.c isatty.c isinf.c isnan.c jrand48.c lcong48.c \
+	libc_dlopen.c \
 	lockf.c lrand48.c mrand48.c nftw.c nice.c \
 	nlist.c nrand48.c opendir.c \
 	pause.c pmadvise.c popen.c posix_spawn.c \

lib/libc/gen/Symbol.map

@@ -369,6 +369,10 @@ FBSD_1.2 {
 	getpagesizes;
 };
 
+FBSD_1.3 {
+	__FreeBSD_libc_enter_restricted_mode;
+};
+
 FBSDprivate_1.0 {
 	/* needed by thread libraries */
 	__thr_jtable;

lib/libc/gen/libc_dlopen.c

@@ -0,0 +1,61 @@
+/*-
+ * Copyright (c) 2011 Xin Li <delphij@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <dlfcn.h>
+#include <stddef.h>
+#include <unistd.h>
+
+#include "libc_private.h"
+
+/*
+ * Whether we want to restrict dlopen()s.
+ */
+static int __libc_restricted_mode = 0;
+
+void *
+libc_dlopen(const char *path, int mode)
+{
+
+	if (__libc_restricted_mode) {
+		_rtld_error("Service unavailable -- libc in restricted mode");
+		return (NULL);
+	} else
+		return (dlopen(path, mode));
+}
+
+void
+__FreeBSD_libc_enter_restricted_mode(void)
+{
+
+	__libc_restricted_mode = 1;
+	return;
+}
+

lib/libc/include/libc_private.h

@@ -43,6 +43,17 @@
  */
 extern int	__isthreaded;
 
+/*
+ * libc should use libc_dlopen internally, which respects a global
+ * flag where loading of new shared objects can be restricted.
+ */
+void *libc_dlopen(const char *, int);
+
+/*
+ * For dynamic linker.
+ */
+void _rtld_error(const char *fmt, ...);
+
 /*
  * File lock contention is difficult to diagnose without knowing
  * where locks were set. Allow a debug library to be built which

lib/libc/net/nsdispatch.c

@@ -384,7 +384,7 @@ nss_configure(void)
 	confmod = statbuf.st_mtime;
 
 #ifdef NS_CACHING
-	handle = dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL);
+	handle = libc_dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL);
 	if (handle != NULL) {
 		nss_cache_cycle_prevention_func = dlsym(handle,
 			"_nss_cache_cycle_prevention_function");
@@ -497,7 +497,7 @@ nss_load_module(const char *source, nss_module_register_fn reg_fn)
 		if (snprintf(buf, sizeof(buf), "nss_%s.so.%d", mod.name,
 		    NSS_MODULE_INTERFACE_VERSION) >= (int)sizeof(buf))
 			goto fin;
-		mod.handle = dlopen(buf, RTLD_LOCAL|RTLD_LAZY);
+		mod.handle = libc_dlopen(buf, RTLD_LOCAL|RTLD_LAZY);
 		if (mod.handle == NULL) {
 #ifdef _NSS_DEBUG
 			/* This gets pretty annoying since the built-in

lib/libpam/modules/pam_lastlog/pam_lastlog.c

@@ -183,6 +183,11 @@ pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused,
 	pam_err = pam_get_item(pamh, PAM_TTY, (const void **)&tty);
 	if (pam_err != PAM_SUCCESS)
 		goto err;
+	if (tty == NULL) {
+		PAM_LOG("No PAM_TTY");
+		pam_err = PAM_SERVICE_ERR;
+		goto err;
+	}
 	if (strncmp(tty, _PATH_DEV, strlen(_PATH_DEV)) == 0)
 		tty = (const char *)tty + strlen(_PATH_DEV);
 	if (*(const char *)tty == '\0')

lib/libpam/modules/pam_ssh/pam_ssh.c

@@ -91,7 +91,8 @@ static char *const pam_ssh_agent_envp[] = { NULL };
  * struct pam_ssh_key containing the key and its comment.
  */
 static struct pam_ssh_key *
-pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase)
+pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase,
+    int nullok)
 {
 	struct pam_ssh_key *psk;
 	char fn[PATH_MAX];
@@ -101,7 +102,21 @@ pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase)
 	if (snprintf(fn, sizeof(fn), "%s/%s", dir, kfn) > (int)sizeof(fn))
 		return (NULL);
 	comment = NULL;
-	key = key_load_private(fn, passphrase, &comment);
+	/*
+	 * If the key is unencrypted, OpenSSL ignores the passphrase, so
+	 * it will seem like the user typed in the right one.  This allows
+	 * a user to circumvent nullok by providing a dummy passphrase.
+	 * Verify that the key really *is* encrypted by trying to load it
+	 * with an empty passphrase, and if the key is not encrypted,
+	 * accept only an empty passphrase.
+	 */
+	key = key_load_private(fn, NULL, &comment);
+	if (key != NULL && !(*passphrase == '\0' && nullok)) {
+		key_free(key);
+		return (NULL);
+	}
+	if (key == NULL)
+		key = key_load_private(fn, passphrase, &comment);
 	if (key == NULL) {
 		openpam_log(PAM_LOG_DEBUG, "failed to load key from %s\n", fn);
 		return (NULL);
@@ -168,9 +183,6 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
 	if (pam_err != PAM_SUCCESS)
 		return (pam_err);
 
-	if (*passphrase == '\0' && !nullok)
-		goto skip_keys;
-
 	/* switch to user credentials */
 	pam_err = openpam_borrow_cred(pamh, pwd);
 	if (pam_err != PAM_SUCCESS)
@@ -178,7 +190,7 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
 
 	/* try to load keys from all keyfiles we know of */
 	for (kfn = pam_ssh_keyfiles; *kfn != NULL; ++kfn) {
-		psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase);
+		psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase, nullok);
 		if (psk != NULL) {
 			pam_set_data(pamh, *kfn, psk, pam_ssh_free_key);
 			++nkeys;
@@ -188,7 +200,6 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
 	/* switch back to arbitrator credentials */
 	openpam_restore_cred(pamh);
 
- skip_keys:
 	/*
 	 * If we tried an old token and didn't get anything, and
 	 * try_first_pass was specified, try again after prompting the

libexec/ftpd/ftpd.c

@@ -1543,6 +1543,7 @@ skip:
 			reply(550, "Can't change root.");
 			goto bad;
 		}
+		__FreeBSD_libc_enter_restricted_mode();
 	} else	/* real user w/o chroot */
 		homedir = pw->pw_dir;
 	/*

libexec/ftpd/popen.c

@@ -143,6 +143,9 @@ ftpd_popen(char *program, char *type)
 			}
 			(void)close(pdes[1]);
 		}
+		/* Drop privileges before proceeding */
+		if (getuid() != geteuid() && setuid(geteuid()) < 0)
+			_exit(1);
 		if (strcmp(gargv[0], _PATH_LS) == 0) {
 			/* Reset getopt for ls_main() */
 			optreset = optind = optopt = 1;

release/doc/en_US.ISO8859-1/errata/article.sgml

@@ -16,7 +16,7 @@
 
 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
 %release;
-<!ENTITY release.bugfix "8.0-RELEASE">
+<!ENTITY release.bugfix "8.1-RELEASE">
 ]>
 
 <article>
@@ -40,7 +40,7 @@
     <pubdate>$FreeBSD$</pubdate>
 
     <copyright>
-      <year>2009</year>
+      <year>2010</year>
       <holder role="mailto:[email protected]">The &os; Documentation Project</holder>
     </copyright>
 
@@ -129,6 +129,7 @@
       For more information, consult the individual advisories available from
       <ulink url="http://security.FreeBSD.org/"></ulink>.</para>
 
+    <!--
     <informaltable frame="none" pgwide="0">
       <tgroup cols="3">
 	<colspec colwidth="1*">
@@ -143,18 +144,6 @@
 	</thead>
 
 	<tbody>
-	  <row>
-	    <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-09:17.freebsd-update.asc"
-		>SA-09:17.freebsd-update</ulink></entry>
-	    <entry>03&nbsp;December&nbsp;2009</entry>
-	    <entry><para>Inappropriate directory permissions in freebsd-update(8)</para></entry>
-	  </row>
-	  <row>
-	    <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-09:16.rtld.asc"
-		>SA-09:16.rtld</ulink></entry>
-	    <entry>03&nbsp;December&nbsp;2009</entry>
-	    <entry><para>Improper environment sanitization in rtld(1)</para></entry>
-	  </row>
 	  <row>
 	    <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-09:15.ssl.asc"
 		>SA-09:15.ssl</ulink></entry>
@@ -164,6 +153,7 @@
 	</tbody>
       </tgroup>
     </informaltable>
+    -->
 
   </sect1>
 

release/doc/en_US.ISO8859-1/hardware/article.sgml

@@ -30,6 +30,7 @@
       <year>2007</year>
       <year>2008</year>
       <year>2009</year>
+      <year>2010</year>
       <holder role="mailto:[email protected]">The &os; Documentation Project</holder>
     </copyright>
 

release/doc/en_US.ISO8859-1/readme/article.sgml

@@ -24,6 +24,8 @@
       <year>2006</year>
       <year>2007</year>
       <year>2008</year>
+      <year>2009</year>
+      <year>2010</year>
       <holder role="mailto:[email protected]">The &os; Documentation Project</holder>
     </copyright>
 

release/doc/share/sgml/release.dsl

@@ -121,14 +121,7 @@
 		   ((or (equal? arch #f)
 			(equal? arch "")
 			(equal? arch "all"))
-		    (make sequence
-		      (if (and (not (null? role)) (equal? role "7.1"))
-			  (literal " [7.1R]")
-			  (empty-sosofo))
-		      (if (and (not (null? role)) (equal? role "7.2"))
-			  (literal " [7.2R]")
-			  (empty-sosofo))
-		      (process-children-trim))
+		    (process-children-trim))
 		   (else
 		    (make sequence
 		      (literal "[")
@@ -142,12 +135,6 @@
 				(loop (car rest) (cdr rest)))
 			      (empty-sosofo))))
 		      (literal "] ")
-		      (if (and (not (null? role)) (equal? role "7.1"))
-			  (literal " [7.1R] ")
-			  (empty-sosofo))
-		      (if (and (not (null? role)) (equal? role "7.2"))
-			  (literal " [7.2R] ")
-			  (empty-sosofo))
 		      (process-children-trim))))
 		  (if (and (not (null? role)) (equal? role "merged"))
 		      (literal " [" merged-string "]")
@@ -171,14 +158,7 @@
 		   ((or (equal? arch #f)
 			(equal? arch "")
 			(equal? arch "all"))
-		    (make sequence
-		      (if (and (not (null? role)) (equal? role "7.1"))
-			  (literal " [7.1R] ")
-			  (empty-sosofo))
-		      (if (and (not (null? role)) (equal? role "7.2"))
-			  (literal " [7.2R] ")
-			  (empty-sosofo))
-		      (process-children-trim)))
+		    (process-children-trim))
 		   (else
 		    (make sequence
 		      (literal "[")
@@ -192,16 +172,10 @@
 				(loop (car rest) (cdr rest)))
 			      (empty-sosofo))))
 		      (literal "] ")
-		      (if (and (not (null? role)) (equal? role "7.1"))
-			  (literal " [7.1R]")
-			  (empty-sosofo))
-		      (if (and (not (null? role)) (equal? role "7.2"))
-			  (literal " [7.2R]")
-			  (empty-sosofo))
 		      (process-children-trim))))
 		  (if (and (not (null? role)) (equal? role "merged"))
 		      (literal " [" merged-string "]")
-		      (empty-sosofo))))))))
+		      (empty-sosofo)))))))
     ]]>
 
     <![ %output.html; [
@@ -251,24 +225,10 @@
 		     ((or (equal? arch #f)
 			  (equal? arch "")
 			  (equal? arch "all"))
-		      (make sequence
-			(if (and (not (null? role)) (equal? role "7.1"))
-			    (literal " [7.1R] ")
-			    (empty-sosofo))
-			(if (and (not (null? role)) (equal? role "7.2"))
-			    (literal " [7.2R] ")
-			    (empty-sosofo))
-			(process-children)))
+		      (process-children))
 		     (else
 		      (sosofo-append
 		       (make sequence
-			 (make sequence
-			   (if (and (not (null? role)) (equal? role "7.1"))
-			       (literal " [7.1R] ")
-			       (empty-sosofo))
-			   (if (and (not (null? role)) (equal? role "7.2"))
-			       (literal " [7.2R] ")
-			       (empty-sosofo)))
 			 (literal "[")
 			 (let loop ((prev (car (split-string-to-list arch)))
 				    (rest (cdr (split-string-to-list arch))))

release/doc/share/sgml/release.ent

@@ -6,21 +6,21 @@
 
 <!-- Version of the OS we're describing.  This needs to be updated
      with each new release. -->
-<!ENTITY release.current "8.0-RELEASE">
+<!ENTITY release.current "8.1-RELEASE">
 
 <!-- The previous version used for comparison in the "What's New"
      section.  For -CURRENT, we might point back to the last
      branchpoint. -->
-<!ENTITY release.prev "7.0-RELEASE">
+<!ENTITY release.prev "8.0-RELEASE">
 
 <!-- The next version to be released, usually used for snapshots. -->
-<!ENTITY release.next "8.1-RELEASE">
+<!ENTITY release.next "8.2-RELEASE">
 
 <!-- The name of this branch. -->
-<!ENTITY release.branch "8-STABLE">
+<!ENTITY release.branch "8.0-STABLE">
 
 <!-- The URL for obtaining this version of FreeBSD. -->
-<!ENTITY release.url "ftp://ftp.FreeBSD.org/">
+<!ENTITY release.url "http://www.FreeBSD.org/">
 
 <!-- The type of release (usually this will be either "snapshot"
      or "release" -->
@@ -31,10 +31,10 @@
 
 <!-- The manpaths for man page references -->
 <!ENTITY release.man.url "http://www.FreeBSD.org/cgi/man.cgi">
-<!ENTITY release.manpath.xorg          "7.4">
-<!ENTITY release.manpath.netbsd        "5.0.1">
+<!ENTITY release.manpath.xorg          "7.5">
+<!ENTITY release.manpath.netbsd        "5.0.2">
 <!ENTITY release.manpath.freebsd-ports "Ports">
-<!ENTITY release.manpath.freebsd       "8.0-RELEASE">
+<!ENTITY release.manpath.freebsd       "8.1-RELEASE">
 
 <!-- Text constants which probably don't need to be changed.-->
 
@@ -48,8 +48,11 @@
 <!ENTITY arch.arm "arm">
 <!ENTITY arch.i386 "i386">
 <!ENTITY arch.ia64 "ia64">
-<!ENTITY arch.mips "MIPS">
+<!ENTITY arch.mips "mips">
 <!ENTITY arch.pc98 "pc98">
 <!ENTITY arch.powerpc "powerpc">
 <!ENTITY arch.sparc64 "sparc64">
 <!ENTITY arch.sun4v "sun4v">
+
+<!-- The marker for MFCs. -->
+<!ENTITY merged "MERGED">

release/scripts/package-split.py

@@ -52,52 +52,21 @@ def disc1_packages():
 
     if doing_dvd:
 	pkgs.extend(['archivers/unzip',
-	    'astro/xearth',
-	    'devel/gmake',
-	    'devel/imake',
-	    'editors/emacs',
-	    'editors/vim-lite',
 	    'emulators/linux_base-f10',
-	    'emulators/mtools',
-	    'graphics/png',
-	    'graphics/xv',
-	    'irc/xchat',
-	    'lang/perl5.8',
-	    'mail/alpine',
-	    'mail/exim',
-	    'mail/fetchmail',
-	    'mail/mutt',
-	    'mail/popd',
-	    'mail/postfix',
-	    'mail/xfmail',
-	    'net/cvsup-without-gui',
+	    'lang/perl5.10',
+	    'net/mpd5',
 	    'net/rsync',
-	    'net/samba3',
-	    'news/slrn',
-	    'news/tin',
 	    'ports-mgmt/p5-FreeBSD-Portindex',
 	    'ports-mgmt/portaudit',
 	    'ports-mgmt/portmaster',
 	    'ports-mgmt/portupgrade',
-	    'print/a2ps-letter',
-	    'print/apsfilter',
-	    'print/ghostscript7-nox11',
-	    'print/psutils-letter',
-	    'print/gv',
 	    'shells/bash',
-	    'shells/pdksh',
 	    'shells/zsh',
 	    'security/sudo',
 	    'sysutils/screen',
-	    'www/links',
-	    'www/lynx',
 	    'x11/gnome2',
 	    'x11/kde4',
-	    'x11/rxvt',
-	    'x11/xorg',
-	    'x11-wm/afterstep',
-	    'x11-wm/fvwm2',
-	    'x11-wm/windowmaker'])
+	    'x11/xorg'])
     return pkgs
 
 # The list of desired packages

sbin/hastd/ebuf.c

@@ -55,8 +55,8 @@ struct ebuf {
 	size_t		 eb_size;
 };
 
-static int ebuf_head_extent(struct ebuf *eb, size_t size);
-static int ebuf_tail_extent(struct ebuf *eb, size_t size);
+static int ebuf_head_extend(struct ebuf *eb, size_t size);
+static int ebuf_tail_extend(struct ebuf *eb, size_t size);
 
 struct ebuf *
 ebuf_alloc(size_t size)
@@ -110,7 +110,7 @@ ebuf_add_head(struct ebuf *eb, const void *data, size_t size)
 		 * We can't add more entries at the front, so we have to extend
 		 * our buffer.
 		 */
-		if (ebuf_head_extent(eb, size) < 0)
+		if (ebuf_head_extend(eb, size) < 0)
 			return (-1);
 	}
 	assert(size <= (size_t)(eb->eb_used - eb->eb_start));
@@ -137,13 +137,13 @@ ebuf_add_tail(struct ebuf *eb, const void *data, size_t size)
 		 * We can't add more entries at the back, so we have to extend
 		 * our buffer.
 		 */
-		if (ebuf_tail_extent(eb, size) < 0)
+		if (ebuf_tail_extend(eb, size) < 0)
 			return (-1);
 	}
 	assert(size <= (size_t)(eb->eb_end - (eb->eb_used + eb->eb_size)));
 
 	/*
-	 * If data is NULL the caller just wants to reserve place.
+	 * If data is NULL the caller just wants to reserve space.
 	 */
 	if (data != NULL)
 		bcopy(data, eb->eb_used + eb->eb_size, size);
@@ -203,7 +203,7 @@ ebuf_size(struct ebuf *eb)
  * Function adds size + (PAGE_SIZE / 4) bytes at the front of the buffer..
  */
 static int
-ebuf_head_extent(struct ebuf *eb, size_t size)
+ebuf_head_extend(struct ebuf *eb, size_t size)
 {
 	unsigned char *newstart, *newused;
 	size_t newsize;
@@ -231,7 +231,7 @@ ebuf_head_extent(struct ebuf *eb, size_t size)
  * Function adds size + ((3 * PAGE_SIZE) / 4) bytes at the back.
  */
 static int
-ebuf_tail_extent(struct ebuf *eb, size_t size)
+ebuf_tail_extend(struct ebuf *eb, size_t size)
 {
 	unsigned char *newstart;
 	size_t newsize;

sbin/hastd/hast_proto.c

@@ -329,9 +329,7 @@ hast_proto_recv_hdr(struct proto_conn *conn, struct nv **nvp)
 	*nvp = nv;
 	return (0);
 fail:
-	if (nv != NULL)
-		nv_free(nv);
-	else if (eb != NULL)
+	if (eb != NULL)
 		ebuf_free(eb);
 	return (-1);
 }

sbin/hastd/hastd.c

@@ -200,7 +200,7 @@ listen_accept(void)
 
 	proto_local_address(conn, laddr, sizeof(laddr));
 	proto_remote_address(conn, raddr, sizeof(raddr));
-	pjdlog_info("Connection from %s to %s.", laddr, raddr);
+	pjdlog_info("Connection from %s to %s.", raddr, laddr);
 
 	/* Error in setting timeout is not critical, but why should it fail? */
 	if (proto_timeout(conn, HAST_TIMEOUT) < 0)
@@ -286,7 +286,7 @@ listen_accept(void)
 	if (token != NULL && memcmp(token, res->hr_token,
 	    sizeof(res->hr_token)) != 0) {
 		pjdlog_error("Token received from %s doesn't match.", raddr);
-		nv_add_stringf(nverr, "errmsg", "Toke doesn't match.");
+		nv_add_stringf(nverr, "errmsg", "Token doesn't match.");
 		goto fail;
 	}
 	/*
@@ -400,7 +400,11 @@ static void
 main_loop(void)
 {
 	fd_set rfds, wfds;
-	int fd, maxfd, ret;
+	int cfd, lfd, maxfd, ret;
+
+	cfd = proto_descriptor(cfg->hc_controlconn);
+	lfd = proto_descriptor(cfg->hc_listenconn);
+	maxfd = cfd > lfd ? cfd : lfd;
 
 	for (;;) {
 		if (sigchld_received) {
@@ -412,22 +416,13 @@ main_loop(void)
 			hastd_reload();
 		}
 
-		maxfd = 0;
-		FD_ZERO(&rfds);
-		FD_ZERO(&wfds);
-
 		/* Setup descriptors for select(2). */
-#define	SETUP_FD(conn)	do {						\
-	fd = proto_descriptor(conn);					\
-	if (fd >= 0) {							\
-		maxfd = fd > maxfd ? fd : maxfd;			\
-		FD_SET(fd, &rfds);					\
-		FD_SET(fd, &wfds);					\
-	}								\
-} while (0)
-		SETUP_FD(cfg->hc_controlconn);
-		SETUP_FD(cfg->hc_listenconn);
-#undef	SETUP_FD
+		FD_ZERO(&rfds);
+		FD_SET(cfd, &rfds);
+		FD_SET(lfd, &rfds);
+		FD_ZERO(&wfds);
+		FD_SET(cfd, &wfds);
+		FD_SET(lfd, &wfds);
 
 		ret = select(maxfd + 1, &rfds, &wfds, NULL, NULL);
 		if (ret == -1) {
@@ -437,13 +432,10 @@ main_loop(void)
 			pjdlog_exit(EX_OSERR, "select() failed");
 		}
 
-#define	ISSET_FD(conn)	\
-	(FD_ISSET((fd = proto_descriptor(conn)), &rfds) || FD_ISSET(fd, &wfds))
-		if (ISSET_FD(cfg->hc_controlconn))
+		if (FD_ISSET(cfd, &rfds) || FD_ISSET(cfd, &wfds))
 			control_handle(cfg);
-		if (ISSET_FD(cfg->hc_listenconn))
+		if (FD_ISSET(lfd, &rfds) || FD_ISSET(lfd, &wfds))
 			listen_accept();
-#undef	ISSET_FD
 	}
 }
 

sbin/hastd/metadata.c

@@ -96,6 +96,7 @@ metadata_read(struct hast_resource *res, bool openrw)
 		rerrno = errno;
 		pjdlog_errno(LOG_ERR,
 		    "Unable to allocate memory to read metadata");
+		ebuf_free(eb);
 		goto fail;
 	}
 	buf = ebuf_data(eb, NULL);
@@ -154,6 +155,7 @@ metadata_read(struct hast_resource *res, bool openrw)
 		nv_free(nv);
 		goto fail;
 	}
+	nv_free(nv);
 	return (0);
 fail:
 	if (opened_here) {
@@ -172,6 +174,7 @@ metadata_write(struct hast_resource *res)
 	unsigned char *buf, *ptr;
 	size_t size;
 	ssize_t done;
+	int ret;
 
 	buf = calloc(1, METADATA_SIZE);
 	if (buf == NULL) {
@@ -180,6 +183,8 @@ metadata_write(struct hast_resource *res)
 		return (-1);
 	}
 
+	ret = -1;
+
 	nv = nv_alloc();
 	nv_add_string(nv, res->hr_name, "resource");
 	nv_add_uint64(nv, (uint64_t)res->hr_datasize, "datasize");
@@ -199,7 +204,7 @@ metadata_write(struct hast_resource *res)
 	nv_add_string(nv, role2str(res->hr_role), "prevrole");
 	if (nv_error(nv) != 0) {
 		pjdlog_error("Unable to create metadata.");
-		goto fail;
+		goto end;
 	}
 	res->hr_previous_role = res->hr_role;
 	eb = nv_hton(nv);
@@ -211,12 +216,11 @@ metadata_write(struct hast_resource *res)
 	done = pwrite(res->hr_localfd, buf, METADATA_SIZE, 0);
 	if (done < 0 || done != METADATA_SIZE) {
 		pjdlog_errno(LOG_ERR, "Unable to write metadata");
-		goto fail;
+		goto end;
 	}
-
-	return (0);
-fail:
+	ret = 0;
+end:
 	free(buf);
 	nv_free(nv);
-	return (-1);
+	return (ret);
 }

sbin/hastd/nv.c

@@ -707,8 +707,10 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 		assert(errno != 0);
 		if (nv->nv_error == 0)
 			nv->nv_error = errno;
+		free(nvh);
 		return;
 	}
+	free(nvh);
 	/* Add the actual data. */
 	if (ebuf_add_tail(nv->nv_ebuf, value, vsize) < 0) {
 		assert(errno != 0);

sbin/hastd/primary.c

@@ -195,7 +195,10 @@ static pthread_mutex_t metadata_lock;
 	mtx_unlock(&hio_##name##_list_lock);				\
 } while (0)
 
-#define	SYNCREQ(hio)		do { (hio)->hio_ggio.gctl_unit = -1; } while (0)
+#define	SYNCREQ(hio)		do {					\
+	(hio)->hio_ggio.gctl_unit = -1;					\
+	(hio)->hio_ggio.gctl_seq = 1;					\
+} while (0)
 #define	ISSYNCREQ(hio)		((hio)->hio_ggio.gctl_unit == -1)
 #define	SYNCREQDONE(hio)	do { (hio)->hio_ggio.gctl_unit = -2; } while (0)
 #define	ISSYNCREQDONE(hio)	((hio)->hio_ggio.gctl_unit == -2)
@@ -447,6 +450,7 @@ init_local(struct hast_resource *res)
 		primary_exit(EX_NOINPUT, "Unable to read activemap");
 	}
 	activemap_copyin(res->hr_amp, buf, mapsize);
+	free(buf);
 	if (res->hr_resuid != 0)
 		return;
 	/*

sbin/hastd/secondary.c

@@ -295,6 +295,7 @@ init_remote(struct hast_resource *res, struct nv *nvin)
 		nv_free(nvout);
 		exit(EX_TEMPFAIL);
 	}
+	nv_free(nvout);
 	if (res->hr_secondary_localcnt > res->hr_primary_remotecnt &&
 	     res->hr_primary_localcnt > res->hr_secondary_remotecnt) {
 		/* Exit on split-brain. */
@@ -687,7 +688,7 @@ send_thread(void *arg)
 			pjdlog_exit(EX_TEMPFAIL, "Unable to send reply.");
 		}
 		nv_free(nvout);
-		pjdlog_debug(2, "disk: (%p) Moving request to the free queue.",
+		pjdlog_debug(2, "send: (%p) Moving request to the free queue.",
 		    hio);
 		nv_free(hio->hio_nv);
 		hio->hio_error = 0;

secure/lib/libcrypt/crypt-des.c

@@ -606,7 +606,7 @@ crypt_des(const char *key, const char *setting)
 	q = (u_char *)keybuf;
 	while (q - (u_char *)keybuf - 8) {
 		*q++ = *key << 1;
-		if (*(q - 1))
+		if (*key != '\0')
 			key++;
 	}
 	if (des_setkey((char *)keybuf))

share/examples/cvsup/standard-supfile

@@ -49,7 +49,7 @@
 *default host=CHANGE_THIS.FreeBSD.org
 *default base=/var/db
 *default prefix=/usr
-*default release=cvs tag=RELENG_8
+*default release=cvs tag=RELENG_8_1
 *default delete use-rel-suffix
 
 # If you seem to be limited by CPU rather than network or disk bandwidth, try

sys/amd64/amd64/trap.c

@@ -1010,4 +1010,21 @@ syscall(struct trapframe *frame)
 	STOPEVENT(p, S_SCX, sa.code);
 
 	PTRACESTOP_SC(p, td, S_PT_SCX);
+
+	/*
+	 * If the user-supplied value of %rip is not a canonical
+	 * address, then some CPUs will trigger a ring 0 #GP during
+	 * the sysret instruction.  However, the fault handler would
+	 * execute with the user's %gs and %rsp in ring 0 which would
+	 * not be safe.  Instead, preemptively kill the thread with a
+	 * SIGBUS.
+	 */
+	if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) {
+		ksiginfo_init_trap(&ksi);
+		ksi.ksi_signo = SIGBUS;
+		ksi.ksi_code = BUS_OBJERR;
+		ksi.ksi_trapno = T_PROTFLT;
+		ksi.ksi_addr = (void *)td->td_frame->tf_rip;
+		trapsignal(td, &ksi);
+	}
 }

sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zio.c

@@ -33,13 +33,9 @@
 #include <sys/zio_compress.h>
 #include <sys/zio_checksum.h>
 
-#if defined(__amd64__)
-static int zio_use_uma = 1;
-#else
-static int zio_use_uma = 0;
-#endif
 SYSCTL_DECL(_vfs_zfs);
 SYSCTL_NODE(_vfs_zfs, OID_AUTO, zio, CTLFLAG_RW, 0, "ZFS ZIO");
+static int zio_use_uma = 0;
 TUNABLE_INT("vfs.zfs.zio.use_uma", &zio_use_uma);
 SYSCTL_INT(_vfs_zfs_zio, OID_AUTO, use_uma, CTLFLAG_RDTUN, &zio_use_uma, 0,
     "Use uma(9) for ZIO allocations");

sys/compat/linux/linux_socket.c

@@ -103,6 +103,7 @@ do_sa_get(struct sockaddr **sap, const struct osockaddr *osa, int *osalen,
 	int oldv6size;
 	struct sockaddr_in6 *sin6;
 #endif
+	int namelen;
 
 	if (*osalen < 2 || *osalen > UCHAR_MAX || !osa)
 		return (EINVAL);
@@ -165,6 +166,20 @@ do_sa_get(struct sockaddr **sap, const struct osockaddr *osa, int *osalen,
 		}
 	}
 
+	if ((bdom == AF_LOCAL) && (*osalen > sizeof(struct sockaddr_un))) {
+		for (namelen = 0;
+		    namelen < *osalen - offsetof(struct sockaddr_un, sun_path);
+		    namelen++)
+			if (!((struct sockaddr_un *)kosa)->sun_path[namelen])
+				break;
+		if (namelen + offsetof(struct sockaddr_un, sun_path) >
+		    sizeof(struct sockaddr_un)) {
+			error = EINVAL;
+			goto out;
+		}
+		alloclen = sizeof(struct sockaddr_un);
+	}
+
 	sa = (struct sockaddr *) kosa;
 	sa->sa_family = bdom;
 	sa->sa_len = alloclen;

sys/conf/newvers.sh

@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="8.1"
-BRANCH="PRERELEASE"
+BRANCH="RELEASE-p13"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi

sys/dev/acpica/acpi_cpu.c

@@ -1009,6 +1009,8 @@ acpi_cpu_notify(ACPI_HANDLE h, UINT32 notify, void *context)
 	if (isc->cpu_cx_count > cpu_cx_count)
 	    cpu_cx_count = isc->cpu_cx_count;
     }
+    if (sc->cpu_cx_lowest < cpu_cx_lowest)
+	acpi_cpu_set_cx_lowest(sc, min(cpu_cx_lowest, sc->cpu_cx_count - 1));
     ACPI_SERIAL_END(cpu);
 }
 
@@ -1204,7 +1206,7 @@ acpi_cpu_global_cx_lowest_sysctl(SYSCTL_HANDLER_ARGS)
     ACPI_SERIAL_BEGIN(cpu);
     for (i = 0; i < cpu_ndevices; i++) {
 	sc = device_get_softc(cpu_devices[i]);
-	acpi_cpu_set_cx_lowest(sc, val);
+	acpi_cpu_set_cx_lowest(sc, min(val, sc->cpu_cx_count - 1));
     }
     ACPI_SERIAL_END(cpu);
 

sys/dev/ath/ath_hal/ar5416/ar5416reg.h

@@ -612,7 +612,7 @@
 	 AH_PRIVATE((_ah))->ah_macRev == AR_XSREV_REVISION_MERLIN_20)
 #define	AR_SREV_MERLIN_20_OR_LATER(_ah) \
 	(AR_SREV_MERLIN_20(_ah) || \
-	 AH_PRIVATE((_ah))->ah_macVersion > AR_XSREV_VERSION_MERLIN)
+	 AH_PRIVATE((_ah))->ah_macVersion >= AR_XSREV_VERSION_MERLIN)
 
 #define	AR_SREV_KITE(_ah) \
 	(AH_PRIVATE((_ah))->ah_macVersion == AR_XSREV_VERSION_KITE)

sys/dev/hptiop/hptiop.c

@@ -1823,6 +1823,10 @@ scsi_done:
 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
 		strncpy(cpi->hba_vid, "HPT   ", HBA_IDLEN);
 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
+		cpi->transport = XPORT_SPI;
+		cpi->transport_version = 2;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_2;
 		cpi->ccb_h.status = CAM_REQ_CMP;
 		break;
 	}

sys/dev/hptmv/entry.c

@@ -2414,6 +2414,10 @@ hpt_action(struct cam_sim *sim, union ccb *ccb)
 			strncpy(cpi->hba_vid, "HPT   ", HBA_IDLEN);
 			strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 			cpi->unit_number = cam_sim_unit(sim);
+			cpi->transport = XPORT_SPI;
+			cpi->transport_version = 2;
+			cpi->protocol = PROTO_SCSI;
+			cpi->protocol_version = SCSI_REV_2;
 			cpi->ccb_h.status = CAM_REQ_CMP;
 			xpt_done(ccb);
 			break;

sys/geom/gate/g_gate.c

@@ -210,7 +210,7 @@ g_gate_start(struct bio *bp)
 }
 
 static struct g_gate_softc *
-g_gate_hold(u_int unit, const char *name)
+g_gate_hold(int unit, const char *name)
 {
 	struct g_gate_softc *sc = NULL;
 
@@ -572,8 +572,8 @@ g_gate_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct threa
 
 		switch (bp->bio_cmd) {
 		case BIO_READ:
-			break;
 		case BIO_DELETE:
+			break;
 		case BIO_WRITE:
 			error = copyout(bp->bio_data, ggio->gctl_data,
 			    bp->bio_length);

sys/ia64/ia64/busdma_machdep.c

@@ -48,7 +48,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/bus.h>
 #include <machine/md_var.h>
 
-#define MAX_BPAGES 256
+#define	MAX_BPAGES	1024
 
 struct bus_dma_tag {
 	bus_dma_tag_t	  parent;
@@ -77,7 +77,7 @@ struct bounce_page {
 	STAILQ_ENTRY(bounce_page) links;
 };
 
-int busdma_swi_pending;
+u_int busdma_swi_pending;
 
 static struct mtx bounce_lock;
 static STAILQ_HEAD(bp_list, bounce_page) bounce_page_list;

sys/ia64/ia64/exception.S

@@ -170,6 +170,27 @@ ENTRY_NOPROFILE(exception_save, 0)
 	 *	r30,r31=trapframe pointers
 	 *	p14,p15=memory stack switch
 	 */
+
+	/* PTC.G enter non-exclusive */
+	mov	r24 = ar.ccv
+	movl	r25 = pmap_ptc_g_sem
+	;;
+.ptc_g_0:
+	ld8.acq	r26 = [r25]
+	;;
+	tbit.nz	p12, p0 = r26, 63
+(p12)	br.cond.spnt.few .ptc_g_0
+	;;
+	mov	ar.ccv = r26
+	adds	r27 = 1, r26
+	;;
+	cmpxchg8.rel	r27 = [r25], r27, ar.ccv
+	;;
+	cmp.ne	p12, p0 = r26, r27
+(p12)	br.cond.spnt.few .ptc_g_0
+	;;
+	mov	ar.ccv = r24
+
 exception_save_restart:
 {	.mmi
 	st8		[r30]=r19,16		// length
@@ -407,6 +428,23 @@ exception_save_restart:
 	movl		gp=__gp
 	;;
 }
+
+	/* PTC.G leave non-exclusive */
+	srlz.d
+	movl	r25 = pmap_ptc_g_sem
+	;;
+.ptc_g_1:
+	ld8.acq r26 = [r25]
+	;;
+	mov	ar.ccv = r26
+	adds	r27 = -1, r26
+	;;
+	cmpxchg8.rel	r27 = [r25], r27, ar.ccv
+	;;
+	cmp.ne	p12, p0 = r26, r27
+(p12)	br.cond.spnt.few .ptc_g_1
+	;;
+
 {	.mib
 	srlz.d
 	nop		0

sys/ia64/ia64/pmap.c

@@ -182,7 +182,8 @@ static uint64_t pmap_ptc_e_count1 = 3;
 static uint64_t pmap_ptc_e_count2 = 2;
 static uint64_t pmap_ptc_e_stride1 = 0x2000;
 static uint64_t pmap_ptc_e_stride2 = 0x100000000;
-struct mtx pmap_ptcmutex;
+
+volatile u_long pmap_ptc_g_sem;
 
 /*
  * Data for the RID allocator
@@ -340,7 +341,6 @@ pmap_bootstrap()
 		       pmap_ptc_e_count2,
 		       pmap_ptc_e_stride1,
 		       pmap_ptc_e_stride2);
-	mtx_init(&pmap_ptcmutex, "Global PTC lock", NULL, MTX_SPIN);
 
 	/*
 	 * Setup RIDs. RIDs 0..7 are reserved for the kernel.
@@ -540,7 +540,8 @@ pmap_invalidate_page(vm_offset_t va)
 {
 	struct ia64_lpte *pte;
 	struct pcpu *pc;
-	uint64_t tag;
+	uint64_t tag, sem;
+	register_t is;
 	u_int vhpt_ofs;
 
 	critical_enter();
@@ -550,10 +551,32 @@ pmap_invalidate_page(vm_offset_t va)
 		pte = (struct ia64_lpte *)(pc->pc_md.vhpt + vhpt_ofs);
 		atomic_cmpset_64(&pte->tag, tag, 1UL << 63);
 	}
-	critical_exit();
-	mtx_lock_spin(&pmap_ptcmutex);
+
+	/* PTC.G enter exclusive */
+	is = intr_disable();
+
+	/* Atomically assert writer after all writers have gone. */
+	do {
+		/* Wait until there's no more writer. */
+		do {
+			sem = atomic_load_acq_long(&pmap_ptc_g_sem);
+			tag = sem | (1ul << 63);
+		} while (sem == tag);
+	} while (!atomic_cmpset_rel_long(&pmap_ptc_g_sem, sem, tag));
+
+	/* Wait until all readers are gone. */
+	tag = (1ul << 63);
+	do {
+		sem = atomic_load_acq_long(&pmap_ptc_g_sem);
+	} while (sem != tag);
+
 	ia64_ptc_ga(va, PAGE_SHIFT << 2);
-	mtx_unlock_spin(&pmap_ptcmutex);
+
+	/* PTC.G leave exclusive */
+	atomic_store_rel_long(&pmap_ptc_g_sem, 0);
+
+	intr_restore(is);
+	critical_exit();
 }
 
 static void

sys/ia64/ia64/vm_machdep.c

@@ -378,9 +378,8 @@ sf_buf_free(struct sf_buf *sf)
  */   
 void  
 swi_vm(void *dummy) 
-{     
-#if 0
+{
+
 	if (busdma_swi_pending != 0)
 		busdma_swi();
-#endif
 }

sys/ia64/include/md_var.h

@@ -75,6 +75,7 @@ struct ia64_init_return {
 extern uint64_t ia64_lapic_addr;
 
 extern long Maxmem;
+extern u_int busdma_swi_pending;
 
 void	busdma_swi(void);
 int	copyout_regstack(struct thread *, uint64_t *, uint64_t *);

sys/kern/uipc_mbuf.c

@@ -302,6 +302,7 @@ mb_dupcl(struct mbuf *n, struct mbuf *m)
 	n->m_ext.ref_cnt = m->m_ext.ref_cnt;
 	n->m_ext.ext_type = m->m_ext.ext_type;
 	n->m_flags |= M_EXT;
+	n->m_flags |= m->m_flags & M_RDONLY;
 }
 
 /*

sys/kern/uipc_syscalls.c

@@ -2413,7 +2413,7 @@ sctp_generic_sendmsg (td, uap)
 	if (error)
 		goto sctp_bad;
 #ifdef KTRACE
-	if (KTRPOINT(td, KTR_STRUCT))
+	if (to && (KTRPOINT(td, KTR_STRUCT)))
 		ktrsockaddr(to);
 #endif
 
@@ -2527,7 +2527,7 @@ sctp_generic_sendmsg_iov(td, uap)
 	if (error)
 		goto sctp_bad1;
 #ifdef KTRACE
-	if (KTRPOINT(td, KTR_STRUCT))
+	if (to && (KTRPOINT(td, KTR_STRUCT)))
 		ktrsockaddr(to);
 #endif
 
@@ -2681,6 +2681,7 @@ sctp_generic_recvmsg(td, uap)
 	if (KTRPOINT(td, KTR_GENIO))
 		ktruio = cloneuio(&auio);
 #endif /* KTRACE */
+	memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo));
 	CURVNET_SET(so->so_vnet);
 	error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL,
 		    fromsa, fromlen, &msg_flags,

sys/kern/uipc_usrreq.c

@@ -394,6 +394,8 @@ uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
 
+	if (soun->sun_len > sizeof(struct sockaddr_un))
+		return (EINVAL);
 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
 	if (namelen <= 0)
 		return (EINVAL);
@@ -1140,6 +1142,8 @@ unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
 
+	if (nam->sa_len > sizeof(struct sockaddr_un))
+		return (EINVAL);
 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
 	if (len <= 0)
 		return (EINVAL);

sys/kern/vfs_subr.c

@@ -822,19 +822,6 @@ static struct kproc_desc vnlru_kp = {
 SYSINIT(vnlru, SI_SUB_KTHREAD_UPDATE, SI_ORDER_FIRST, kproc_start,
     &vnlru_kp);
  
-static void
-vfs_lowmem(void *arg __unused)
-{
-
-	/*
-	 * On low memory condition free 1/8th of the free vnodes.
-	 */
-	mtx_lock(&vnode_free_list_mtx);
-	vnlru_free(freevnodes / 8);
-	mtx_unlock(&vnode_free_list_mtx);
-}
-EVENTHANDLER_DEFINE(vm_lowmem, vfs_lowmem, NULL, 0);
-
 /*
  * Routines having to do with the management of the vnode table.
  */

sys/net/flowtable.c

@@ -1626,7 +1626,7 @@ flowtable_init(const void *unused __unused)
 	    EVENTHANDLER_PRI_ANY);
 	flowclean_freq = 20*hz;
 }
-SYSINIT(flowtable_init, SI_SUB_SMP, SI_ORDER_MIDDLE,
+SYSINIT(flowtable_init, SI_SUB_KTHREAD_INIT, SI_ORDER_FIRST,
     flowtable_init, NULL);
 
 

sys/net/if.c

@@ -1636,7 +1636,7 @@ done:
  * is most specific found.
  */
 struct ifaddr *
-ifa_ifwithnet(struct sockaddr *addr)
+ifa_ifwithnet(struct sockaddr *addr, int ignore_ptp)
 {
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
@@ -1668,7 +1668,8 @@ ifa_ifwithnet(struct sockaddr *addr)
 
 			if (ifa->ifa_addr->sa_family != af)
 next:				continue;
-			if (af == AF_INET && ifp->if_flags & IFF_POINTOPOINT) {
+			if (af == AF_INET && 
+			    ifp->if_flags & IFF_POINTOPOINT && !ignore_ptp) {
 				/*
 				 * This is a bit broken as it doesn't
 				 * take into account that the remote end may

sys/net/if_var.h

@@ -875,7 +875,7 @@ struct	ifaddr *ifa_ifwithaddr(struct sockaddr *);
 int		ifa_ifwithaddr_check(struct sockaddr *);
 struct	ifaddr *ifa_ifwithbroadaddr(struct sockaddr *);
 struct	ifaddr *ifa_ifwithdstaddr(struct sockaddr *);
-struct	ifaddr *ifa_ifwithnet(struct sockaddr *);
+struct	ifaddr *ifa_ifwithnet(struct sockaddr *, int);
 struct	ifaddr *ifa_ifwithroute(int, struct sockaddr *, struct sockaddr *);
 struct	ifaddr *ifa_ifwithroute_fib(int, struct sockaddr *, struct sockaddr *, u_int);
 

sys/net/route.c

@@ -519,7 +519,7 @@ rtredirect_fib(struct sockaddr *dst,
 	}
 
 	/* verify the gateway is directly reachable */
-	if ((ifa = ifa_ifwithnet(gateway)) == NULL) {
+	if ((ifa = ifa_ifwithnet(gateway, 0)) == NULL) {
 		error = ENETUNREACH;
 		goto out;
 	}
@@ -686,7 +686,7 @@ ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
 		ifa = ifa_ifwithdstaddr(gateway);
 	}
 	if (ifa == NULL)
-		ifa = ifa_ifwithnet(gateway);
+		ifa = ifa_ifwithnet(gateway, 0);
 	if (ifa == NULL) {
 		struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
 		if (rt == NULL)
@@ -797,7 +797,7 @@ rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
 	 */
 	if (info->rti_ifp == NULL && ifpaddr != NULL &&
 	    ifpaddr->sa_family == AF_LINK &&
-	    (ifa = ifa_ifwithnet(ifpaddr)) != NULL) {
+	    (ifa = ifa_ifwithnet(ifpaddr, 0)) != NULL) {
 		info->rti_ifp = ifa->ifa_ifp;
 		ifa_free(ifa);
 	}

sys/net/rtsock.c

@@ -55,6 +55,7 @@
 #include <net/if.h>
 #include <net/if_dl.h>
 #include <net/if_llatbl.h>
+#include <net/if_types.h>
 #include <net/netisr.h>
 #include <net/raw_cb.h>
 #include <net/route.h>
@@ -673,12 +674,22 @@ route_output(struct mbuf *m, struct socket *so)
 		 * another search to retrieve the prefix route of
 		 * the local end point of the PPP link.
 		 */
-		if ((rtm->rtm_flags & RTF_ANNOUNCE) &&
-		    (rt->rt_ifp->if_flags & IFF_POINTOPOINT)) {
+		if (rtm->rtm_flags & RTF_ANNOUNCE) {
 			struct sockaddr laddr;
-			rt_maskedcopy(rt->rt_ifa->ifa_addr,
-				      &laddr,
-				      rt->rt_ifa->ifa_netmask);
+
+			if (rt->rt_ifp != NULL && 
+			    rt->rt_ifp->if_type == IFT_PROPVIRTUAL) {
+				struct ifaddr *ifa;
+
+				ifa = ifa_ifwithnet(info.rti_info[RTAX_DST], 1);
+				if (ifa != NULL)
+					rt_maskedcopy(ifa->ifa_addr,
+						      &laddr,
+						      ifa->ifa_netmask);
+			} else
+				rt_maskedcopy(rt->rt_ifa->ifa_addr,
+					      &laddr,
+					      rt->rt_ifa->ifa_netmask);
 			/* 
 			 * refactor rt and no lock operation necessary
 			 */

sys/netinet/in.c

@@ -1379,8 +1379,9 @@ in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr
 
 	/* XXX rtalloc1 should take a const param */
 	rt = rtalloc1(__DECONST(struct sockaddr *, l3addr), 0, 0);
-	if (rt == NULL || (rt->rt_flags & RTF_GATEWAY) || 
-	    ((rt->rt_ifp != ifp) && !(flags & LLE_PUB))) {
+	if (rt == NULL || (!(flags & LLE_PUB) &&
+			   ((rt->rt_flags & RTF_GATEWAY) || 
+			    (rt->rt_ifp != ifp)))) {
 #ifdef DIAGNOSTIC
 		log(LOG_INFO, "IPv4 address: \"%s\" is not on the network\n",
 		    inet_ntoa(((const struct sockaddr_in *)l3addr)->sin_addr));

sys/netinet/in_pcb.c

@@ -590,7 +590,7 @@ in_pcbladdr(struct inpcb *inp, struct in_addr *faddr, struct in_addr *laddr,
 
 		ia = ifatoia(ifa_ifwithdstaddr((struct sockaddr *)sin));
 		if (ia == NULL)
-			ia = ifatoia(ifa_ifwithnet((struct sockaddr *)sin));
+			ia = ifatoia(ifa_ifwithnet((struct sockaddr *)sin, 0));
 		if (ia == NULL) {
 			error = ENETUNREACH;
 			goto done;
@@ -707,7 +707,7 @@ in_pcbladdr(struct inpcb *inp, struct in_addr *faddr, struct in_addr *laddr,
 
 		ia = ifatoia(ifa_ifwithdstaddr(sintosa(&sain)));
 		if (ia == NULL)
-			ia = ifatoia(ifa_ifwithnet(sintosa(&sain)));
+			ia = ifatoia(ifa_ifwithnet(sintosa(&sain), 0));
 		if (ia == NULL)
 			ia = ifatoia(ifa_ifwithaddr(sintosa(&sain)));
 

sys/netinet/ip_options.c

@@ -230,7 +230,7 @@ dropit:
 #define	INA	struct in_ifaddr *
 #define	SA	struct sockaddr *
 			    if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == NULL)
-				ia = (INA)ifa_ifwithnet((SA)&ipaddr);
+				    ia = (INA)ifa_ifwithnet((SA)&ipaddr, 0);
 			} else
 /* XXX MRT 0 for routing */
 				ia = ip_rtaddr(ipaddr.sin_addr, M_GETFIB(m));

sys/netinet/ip_output.c

@@ -247,7 +247,7 @@ again:
 		isbroadcast = 1;
 	} else if (flags & IP_ROUTETOIF) {
 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL &&
-		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == NULL) {
+		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst), 0))) == NULL) {
 			IPSTAT_INC(ips_noroute);
 			error = ENETUNREACH;
 			goto bad;

sys/netinet/sctp_asconf.c

@@ -826,6 +826,7 @@ send_reply:
 	ack->serial_number = serial_num;
 	ack->last_sent_to = NULL;
 	ack->data = m_ack;
+	ack->len = 0;
 	n = m_ack;
 	while (n) {
 		ack->len += SCTP_BUF_LEN(n);
@@ -1025,7 +1026,8 @@ sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 		 * address.
 		 */
 		if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
-		    SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index) {
+		    ((ifn == NULL) ||
+		    (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 			/* clear any cached route */
 			RTFREE(net->ro.ro_rt);
 			net->ro.ro_rt = NULL;

sys/netinet/sctp_pcb.c

@@ -3074,6 +3074,9 @@ sctp_iterator_inp_being_freed(struct sctp_inpcb *inp)
 				SCTP_FREE(it, SCTP_M_ITER);
 			} else {
 				it->inp = LIST_NEXT(it->inp, sctp_list);
+				if (it->inp) {
+					SCTP_INP_INCR_REF(it->inp);
+				}
 			}
 			/*
 			 * When its put in the refcnt is incremented so decr
@@ -3114,17 +3117,10 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
 #ifdef SCTP_LOG_CLOSING
 	sctp_log_closing(inp, NULL, 0);
 #endif
-	if (from == SCTP_CALLED_AFTER_CMPSET_OFCLOSE) {
-		/*
-		 * Once we are in we can remove the flag from = 1 is only
-		 * passed from the actual closing routines that are called
-		 * via the sockets layer.
-		 */
-		SCTP_ITERATOR_LOCK();
-		/* mark any iterators on the list or being processed */
-		sctp_iterator_inp_being_freed(inp);
-		SCTP_ITERATOR_UNLOCK();
-	}
+	SCTP_ITERATOR_LOCK();
+	/* mark any iterators on the list or being processed */
+	sctp_iterator_inp_being_freed(inp);
+	SCTP_ITERATOR_UNLOCK();
 	so = inp->sctp_socket;
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 		/* been here before.. eeks.. get out of here */
@@ -4637,7 +4633,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 		atomic_add_int(&stcb->asoc.refcnt, 1);
 
 		SCTP_TCB_UNLOCK(stcb);
-
 		SCTP_INP_INFO_WLOCK();
 		SCTP_INP_WLOCK(inp);
 		SCTP_TCB_LOCK(stcb);
@@ -4680,6 +4675,16 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
 		atomic_add_int(&stcb->asoc.refcnt, -1);
 	}
+	if (stcb->asoc.refcnt) {
+		stcb->asoc.state &= ~SCTP_STATE_IN_ACCEPT_QUEUE;
+		sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
+		if (from_inpcbfree == SCTP_NORMAL_PROC) {
+			SCTP_INP_INFO_WUNLOCK();
+			SCTP_INP_WUNLOCK(inp);
+		}
+		SCTP_TCB_UNLOCK(stcb);
+		return (0);
+	}
 	asoc->state = 0;
 	if (inp->sctp_tcbhash) {
 		LIST_REMOVE(stcb, sctp_tcbhash);

sys/netinet/tcp_input.c

@@ -293,6 +293,8 @@ tcp6_input(struct mbuf **mp, int *offp, int proto)
 			    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
 		return IPPROTO_DONE;
 	}
+	if (ia6)
+		ifa_free(&ia6->ia_ifa);
 
 	tcp_input(m, *offp);
 	return IPPROTO_DONE;
@@ -941,7 +943,8 @@ relocked:
 				rstreason = BANDLIM_RST_OPENPORT;
 				goto dropwithreset;
 			}
-			ifa_free(&ia6->ia_ifa);
+			if (ia6)
+				ifa_free(&ia6->ia_ifa);
 		}
 #endif
 		/*

sys/netinet6/in6.c

@@ -1370,6 +1370,8 @@ in6_purgeaddr(struct ifaddr *ifa)
 	}
 
 cleanup:
+	if (ifa0 != NULL)
+		ifa_free(ifa0);
 
 	plen = in6_mask2len(&ia->ia_prefixmask.sin6_addr, NULL); /* XXX */
 	if ((ia->ia_flags & IFA_ROUTE) && plen == 128) {
@@ -1394,8 +1396,6 @@ cleanup:
 			return;
 		ia->ia_flags &= ~IFA_ROUTE;
 	}
-	if (ifa0 != NULL)
-		ifa_free(ifa0);
 
 	in6_unlink_ifa(ia, ifp);
 }
@@ -1549,14 +1549,19 @@ in6_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data,
 			hostid = IFA_IN6(ifa);
 
 			/* prefixlen must be <= 64. */
-			if (64 < iflr->prefixlen)
+			if (64 < iflr->prefixlen) {
+				if (ifa != NULL)
+					ifa_free(ifa);
 				return EINVAL;
+			}
 			prefixlen = iflr->prefixlen;
 
 			/* hostid part must be zero. */
 			sin6 = (struct sockaddr_in6 *)&iflr->addr;
 			if (sin6->sin6_addr.s6_addr32[2] != 0 ||
 			    sin6->sin6_addr.s6_addr32[3] != 0) {
+				if (ifa != NULL)
+					ifa_free(ifa);
 				return EINVAL;
 			}
 		} else
@@ -2144,14 +2149,20 @@ in6_ifawithifp(struct ifnet *ifp, struct in6_addr *dst)
 		IN6_IFADDR_RUNLOCK();
 		return (struct in6_ifaddr *)ifa;
 	}
-	IN6_IFADDR_RUNLOCK();
 
 	/* use the last-resort values, that are, deprecated addresses */
-	if (dep[0])
+	if (dep[0]) {
+		ifa_ref((struct ifaddr *)dep[0]);
+		IN6_IFADDR_RUNLOCK();
 		return dep[0];
-	if (dep[1])
+	}
+	if (dep[1]) {
+		ifa_ref((struct ifaddr *)dep[1]);
+		IN6_IFADDR_RUNLOCK();
 		return dep[1];
+	}
 
+	IN6_IFADDR_RUNLOCK();
 	return NULL;
 }
 

sys/netinet6/ip6_input.c

@@ -632,19 +632,23 @@ passin:
 	 * as our interface address (e.g. multicast addresses, addresses
 	 * within FAITH prefixes and such).
 	 */
-	if (deliverifp && !ip6_getdstifaddr(m)) {
+	if (deliverifp) {
 		struct in6_ifaddr *ia6;
 
-		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
-		if (ia6) {
-			if (!ip6_setdstifaddr(m, ia6)) {
-				/*
-				 * XXX maybe we should drop the packet here,
-				 * as we could not provide enough information
-				 * to the upper layers.
-				 */
-			}
+ 		if ((ia6 = ip6_getdstifaddr(m)) != NULL) {
 			ifa_free(&ia6->ia_ifa);
+		} else {
+			ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
+			if (ia6) {
+				if (!ip6_setdstifaddr(m, ia6)) {
+					/*
+					 * XXX maybe we should drop the packet here,
+					 * as we could not provide enough information
+					 * to the upper layers.
+					 */
+				}
+				ifa_free(&ia6->ia_ifa);
+			}
 		}
 	}
 

sys/powerpc/aim/mmu_oea.c

@@ -670,6 +670,7 @@ moea_bootstrap(mmu_t mmup, vm_offset_t kernelstart, vm_offset_t kernelend)
 	vm_size_t	size, physsz, hwphyssz;
 	vm_offset_t	pa, va, off;
 	void		*dpcpu;
+	register_t	msr;
 
         /*
          * Set up BAT0 to map the lowest 256 MB area
@@ -700,12 +701,16 @@ moea_bootstrap(mmu_t mmup, vm_offset_t kernelstart, vm_offset_t kernelend)
 
 	/*
 	 * Use an IBAT and a DBAT to map the bottom segment of memory
-	 * where we are.
+	 * where we are. Turn off instruction relocation temporarily
+	 * to prevent faults while reprogramming the IBAT.
 	 */
+	msr = mfmsr();
+	mtmsr(msr & ~PSL_IR);
 	__asm (".balign 32; \n"
 	       "mtibatu 0,%0; mtibatl 0,%1; isync; \n"
 	       "mtdbatu 0,%0; mtdbatl 0,%1; isync"
 	    :: "r"(battable[0].batu), "r"(battable[0].batl));
+	mtmsr(msr);
 
 	/* map pci space */
 	__asm __volatile("mtdbatu 1,%0" :: "r"(battable[8].batu));

sys/sparc64/include/smp.h

@@ -38,6 +38,9 @@
 
 #ifndef	LOCORE
 
+#include <sys/proc.h>
+#include <sys/sched.h>
+
 #include <machine/intr_machdep.h>
 #include <machine/pcb.h>
 #include <machine/tte.h>
@@ -139,6 +142,7 @@ ipi_dcache_page_inval(void *func, vm_paddr_t pa)
 
 	if (smp_cpus == 1)
 		return (NULL);
+	sched_pin();
 	ica = &ipi_cache_args;
 	mtx_lock_spin(&ipi_mtx);
 	ica->ica_mask = all_cpus;
@@ -154,6 +158,7 @@ ipi_icache_page_inval(void *func, vm_paddr_t pa)
 
 	if (smp_cpus == 1)
 		return (NULL);
+	sched_pin();
 	ica = &ipi_cache_args;
 	mtx_lock_spin(&ipi_mtx);
 	ica->ica_mask = all_cpus;
@@ -170,8 +175,11 @@ ipi_tlb_context_demap(struct pmap *pm)
 
 	if (smp_cpus == 1)
 		return (NULL);
-	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0)
+	sched_pin();
+	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0) {
+		sched_unpin();
 		return (NULL);
+	}
 	ita = &ipi_tlb_args;
 	mtx_lock_spin(&ipi_mtx);
 	ita->ita_mask = cpus | PCPU_GET(cpumask);
@@ -189,8 +197,11 @@ ipi_tlb_page_demap(struct pmap *pm, vm_offset_t va)
 
 	if (smp_cpus == 1)
 		return (NULL);
-	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0)
+	sched_pin();
+	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0) {
+		sched_unpin();
 		return (NULL);
+	}
 	ita = &ipi_tlb_args;
 	mtx_lock_spin(&ipi_mtx);
 	ita->ita_mask = cpus | PCPU_GET(cpumask);
@@ -208,8 +219,11 @@ ipi_tlb_range_demap(struct pmap *pm, vm_offset_t start, vm_offset_t end)
 
 	if (smp_cpus == 1)
 		return (NULL);
-	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0)
+	sched_pin();
+	if ((cpus = (pm->pm_active & PCPU_GET(other_cpus))) == 0) {
+		sched_unpin();
 		return (NULL);
+	}
 	ita = &ipi_tlb_args;
 	mtx_lock_spin(&ipi_mtx);
 	ita->ita_mask = cpus | PCPU_GET(cpumask);
@@ -230,6 +244,7 @@ ipi_wait(void *cookie)
 		while (*mask != 0)
 			;
 		mtx_unlock_spin(&ipi_mtx);
+		sched_unpin();
 	}
 }
 
@@ -242,35 +257,36 @@ ipi_wait(void *cookie)
 #ifndef	LOCORE
 
 static __inline void *
-ipi_dcache_page_inval(void *func, vm_paddr_t pa)
+ipi_dcache_page_inval(void *func __unused, vm_paddr_t pa __unused)
 {
 
 	return (NULL);
 }
 
 static __inline void *
-ipi_icache_page_inval(void *func, vm_paddr_t pa)
+ipi_icache_page_inval(void *func __unused, vm_paddr_t pa __unused)
 {
 
 	return (NULL);
 }
 
 static __inline void *
-ipi_tlb_context_demap(struct pmap *pm)
+ipi_tlb_context_demap(struct pmap *pm __unused)
 {
 
 	return (NULL);
 }
 
 static __inline void *
-ipi_tlb_page_demap(struct pmap *pm, vm_offset_t va)
+ipi_tlb_page_demap(struct pmap *pm __unused, vm_offset_t va __unused)
 {
 
 	return (NULL);
 }
 
 static __inline void *
-ipi_tlb_range_demap(struct pmap *pm, vm_offset_t start, vm_offset_t end)
+ipi_tlb_range_demap(struct pmap *pm __unused, vm_offset_t start __unused,
+    __unused vm_offset_t end)
 {
 
 	return (NULL);

sys/sparc64/sparc64/mp_locore.S

@@ -207,7 +207,7 @@ ENTRY(mp_startup)
 	bl	%icc, 2f
 	 nop
 	cmp	%l1, CPU_IMPL_ULTRASPARCIII
-	bl	%icc, 3f
+	bl	%icc, 4f
 	 nop
 2:	mov	CPU_STICKSYNC, %l2
 	membar	#StoreLoad

sys/sys/param.h

@@ -58,7 +58,7 @@
  *		in the range 5 to 9.
  */
 #undef __FreeBSD_version
-#define __FreeBSD_version 800505	/* Master, propagated to newvers */
+#define __FreeBSD_version 801000	/* Master, propagated to newvers */
 
 #ifndef LOCORE
 #include <sys/types.h>

usr.bin/compress/zopen.c

@@ -490,7 +490,7 @@ zread(void *cookie, char *rbp, int num)
 	block_compress = maxbits & BLOCK_MASK;
 	maxbits &= BIT_MASK;
 	maxmaxcode = 1L << maxbits;
-	if (maxbits > BITS) {
+	if (maxbits > BITS || maxbits < 12) {
 		errno = EFTYPE;
 		return (-1);
 	}
@@ -517,17 +517,28 @@ zread(void *cookie, char *rbp, int num)
 			for (code = 255; code >= 0; code--)
 				tab_prefixof(code) = 0;
 			clear_flg = 1;
-			free_ent = FIRST - 1;
-			if ((code = getcode(zs)) == -1)	/* O, untimely death! */
-				break;
+			free_ent = FIRST;
+			oldcode = -1;
+			continue;
 		}
 		incode = code;
 
-		/* Special case for KwKwK string. */
+		/* Special case for kWkWk string. */
 		if (code >= free_ent) {
+			if (code > free_ent || oldcode == -1) {
+				/* Bad stream. */
+				errno = EINVAL;
+				return (-1);
+			}
 			*stackp++ = finchar;
 			code = oldcode;
 		}
+		/*
+		 * The above condition ensures that code < free_ent.
+		 * The construction of tab_prefixof in turn guarantees that
+		 * each iteration decreases code and therefore stack usage is
+		 * bound by 1 << BITS - 256.
+		 */
 
 		/* Generate output characters in reverse order. */
 		while (code >= 256) {
@@ -544,7 +555,7 @@ middle:		do {
 		} while (stackp > de_stack);
 
 		/* Generate the new entry. */
-		if ((code = free_ent) < maxmaxcode) {
+		if ((code = free_ent) < maxmaxcode && oldcode != -1) {
 			tab_prefixof(code) = (u_short) oldcode;
 			tab_suffixof(code) = finchar;
 			free_ent = code + 1;

usr.bin/gzip/zuncompress.c

@@ -247,7 +247,7 @@ zread(void *cookie, char *rbp, int num)
 	zs->zs_block_compress = zs->zs_maxbits & BLOCK_MASK;
 	zs->zs_maxbits &= BIT_MASK;
 	zs->zs_maxmaxcode = 1L << zs->zs_maxbits;
-	if (zs->zs_maxbits > BITS) {
+	if (zs->zs_maxbits > BITS || zs->zs_maxbits < 12) {
 		errno = EFTYPE;
 		return (-1);
 	}
@@ -259,13 +259,7 @@ zread(void *cookie, char *rbp, int num)
 	}
 	zs->zs_free_ent = zs->zs_block_compress ? FIRST : 256;
 
-	zs->u.r.zs_finchar = zs->u.r.zs_oldcode = getcode(zs);
-	if (zs->u.r.zs_oldcode == -1)	/* EOF already? */
-		return (0);	/* Get out of here */
-
-	/* First code must be 8 bits = char. */
-	*bp++ = (u_char)zs->u.r.zs_finchar;
-	count--;
+	zs->u.r.zs_oldcode = -1;
 	zs->u.r.zs_stackp = de_stack;
 
 	while ((zs->u.r.zs_code = getcode(zs)) > -1) {
@@ -275,17 +269,29 @@ zread(void *cookie, char *rbp, int num)
 			    zs->u.r.zs_code--)
 				tab_prefixof(zs->u.r.zs_code) = 0;
 			zs->zs_clear_flg = 1;
-			zs->zs_free_ent = FIRST - 1;
-			if ((zs->u.r.zs_code = getcode(zs)) == -1)	/* O, untimely death! */
-				break;
+			zs->zs_free_ent = FIRST;
+			zs->u.r.zs_oldcode = -1;
+			continue;
 		}
 		zs->u.r.zs_incode = zs->u.r.zs_code;
 
 		/* Special case for KwKwK string. */
 		if (zs->u.r.zs_code >= zs->zs_free_ent) {
+			if (zs->u.r.zs_code > zs->zs_free_ent ||
+			    zs->u.r.zs_oldcode == -1) {
+				/* Bad stream. */
+				errno = EINVAL;
+				return (-1);
+			}
 			*zs->u.r.zs_stackp++ = zs->u.r.zs_finchar;
 			zs->u.r.zs_code = zs->u.r.zs_oldcode;
 		}
+		/*
+		 * The above condition ensures that code < free_ent.
+		 * The construction of tab_prefixof in turn guarantees that
+		 * each iteration decreases code and therefore stack usage is
+		 * bound by 1 << BITS - 256.
+		 */
 
 		/* Generate output characters in reverse order. */
 		while (zs->u.r.zs_code >= 256) {
@@ -302,7 +308,8 @@ middle:		do {
 		} while (zs->u.r.zs_stackp > de_stack);
 
 		/* Generate the new entry. */
-		if ((zs->u.r.zs_code = zs->zs_free_ent) < zs->zs_maxmaxcode) {
+		if ((zs->u.r.zs_code = zs->zs_free_ent) < zs->zs_maxmaxcode &&
+		    zs->u.r.zs_oldcode != -1) {
 			tab_prefixof(zs->u.r.zs_code) = (u_short) zs->u.r.zs_oldcode;
 			tab_suffixof(zs->u.r.zs_code) = zs->u.r.zs_finchar;
 			zs->zs_free_ent = zs->u.r.zs_code + 1;

usr.sbin/freebsd-update/freebsd-update.sh

@@ -1185,7 +1185,7 @@ fetch_metadata_sanity () {
 	# Some aliases to save space later: ${P} is a character which can
 	# appear in a path; ${M} is the four numeric metadata fields; and
 	# ${H} is a sha256 hash.
-	P="[-+./:=_[[:alnum:]]"
+	P="[-+./:=%@_[[:alnum:]]"
 	M="[0-9]+\|[0-9]+\|[0-9]+\|[0-9]+"
 	H="[0-9a-f]{64}"
 

usr.sbin/mountd/mountd.c

@@ -2937,7 +2937,7 @@ makemask(struct sockaddr_storage *ssp, int bitlen)
 
 	for (i = 0; i < len; i++) {
 		bits = (bitlen > CHAR_BIT) ? CHAR_BIT : bitlen;
-		*p++ = (1 << bits) - 1;
+		*p++ = (u_char)~0 << (CHAR_BIT - bits);
 		bitlen -= bits;
 	}
 	return 0;

usr.sbin/sysinstall/tcpip.c

@@ -732,6 +732,9 @@ tcpDeviceSelect(void)
 	return (NULL);
     }
 
+    devs = deviceFind(NULL, DEVICE_TYPE_NETWORK);
+    cnt = deviceCount(devs); 
+
     if ((!RunningAsInit) && (variable_check("NETWORK_CONFIGURED=NO") != TRUE)) {
 	if (!msgYesNo("Running multi-user, assume that the network is already configured?"))
 	    return devs[0];