HardenedBSD-12-STABLE-v1200058.3 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
Highlights:
- MFC r343784: Avoid leaking fp references when truncating SCM_RIGHTS control messages. (0526a0cabfe1cb63e93947a4d34a050a13d97851) [CVE-2019-5596 FreeBSD-SA-19:02.fd]
- MFC r343780: amd64: clear callee-preserved registers on syscall exit. (bd0cbe8cc38d2e67c3d4a9f1c6746a31aa213963 CVE-2019-5595 FreeBSD-SA-19:01.syscall]
- MFC r343587: Add a simple port filter to SIFTR. (ab2d372594adbe95166adfed1d78c0a6c4dc773b)
- MFC r343060: [drm] Fix off-by-one error when accessing driver-specific ioctl handlers array (c53a074639dd8b3b1cdadd80e6860b2a7ade95f7)
- MFC r341472: Add ability to request listing and deleting only for dynamic states. (caad386934df5f897739c80b071dc90d8165008d)
- MFC r343499: rc(8): do not stop dhclient(8) when wpa_supplicant(8) / hostapd(8) is used (0441c4fa5aa5b68927224cfc81ce354772ff10a9)
- MFC r343418: pf: Fix use-after-free of counters (824b38d7e5213d4a94fefb5e0ddda41f95da6321)
- MFC r343395: Fix refcounting leaks in IPv6 MLD code leading to loss of IPv6 connectivity. (69483a2f2af7c93450b276cc0a24e6561009cfda)
- HBSD: Add EFIRT to the HARDENEDBSD amd64 kernel (23220bd7b1eaff08140fe4daa6d0786c7aa713e8)
- HBSD: Disable cfi-icall for mount_nfs and showmount (924afb0d77fd83485b8ba9c3e0a6927585d37858)
- MFC of 343449 and 343483 Update tunefs to allow '_' in label names. (3df852382237702f1c262aaad54933bdf5b2fbed)
- MFC r343363, r343364: Fix an LLE lookup race. (4b6ead634deb05c2b3f0f83b8b1ba3a18708197d) [FreeBSD-EN-19:07.lle]
- MFC r343089: Limit the user-controllable amount of memory the kernel allocates via IPPROTO_SCTP level socket options. (1d3e563dc53e1190bbc635ba00874e51b1548197)
- MFC r342857: Avoid overfow in vtruncbuf() (5dafae63da366cedf24d91d32aa54a4b4a4a8640)
- HBSD: Disable cfi-icall for NFS RPC utilities (d09bc59f69276e1b8b382f3a0ba00cfb2288833d)
- MFC r343082: Implement shmat(2) flag SHM_REMAP. (58501d93bee4827fa9429db046484bf26a8ad40b)
- MFC r343286: nfs: Zero the buffers exported by NFSSVC_DUMPCLIENTS and DUMPLOCKS. (0e46cd7fe5be1edad6471bc1add8fa7702596f3f)
- MFC r343265: hwpmc: Plug memory disclosures from PMC_OP_{GETPMCINFO,GETCPUINFO}. (d5dd66e58281aeb5300f19095ceee3894938de43)
- MFC linuxulator stack memory disclosure fixes (c69e471dfc3ef2730bde80e755b5656e7ac55e1a)
- MFC r343017: Handle overflow in calculating max kmem size. (ef32d9a8bb0d37bce34588d49ca5f972475853f0)
- nvdimm updates
- pf updates
- ipfilter updates
- ipfw updates
- netmap updates
- net80211 updates
Installer images:
http://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/IS...
CHECKSUM.SHA512:
SHA512 (HardenedBSD-12-STABLE-v1200058.3-amd64-bootonly.iso) = 75661d8fc8c6508c6e27ad36c1bc18f5a6a43b95e71623d3b227b29e439b4cf835ab3525343e045e91d9db061b7926722b9342c27d6613534eff632f7b5c4567
SHA512 (HardenedBSD-12-STABLE-v1200058.3-amd64-disc1.iso) = 4d368903e3edbe6ca5290b3ad3a4bf2c85455731839a55b38113283ee7e2ffbdf020c983f6d24fed7141af754e55592f5d55b2d334b108b3f3e5b5a0423c1d32
SHA512 (HardenedBSD-12-STABLE-v1200058.3-amd64-memstick.img) = 8debd3c0702cb3733d6bafbff05c6d54838fa4c5be68fb0cda778cc38a2c5fcc8e85009de30d7e96fe7161c6dfb2edfbf430b76f9380829435423c7cf9e1dc69
SHA512 (HardenedBSD-12-STABLE-v1200058.3-amd64-mini-memstick.img) = 6325fa8feeea551c065e6b6009809c6048a1ed4d2ef6fe657ad1e2ed59345bb72f4fdae0950b69491725b0d46680da81b24cb539a439dc8765c9889a15977fde
CHECKSUM.SHA512.asc:
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEu1M4jTvZiSgVy54wgZsRom/9GI0FAlxaN5gACgkQgZsRom/9
GI3aOhAAtAhGQ2nlQI+bll2DSBj2gV1Ph0z3M1zeL6Wyii1JtZLroLmUHoTnkN5P
smCLgPoNXDQlkRlBTjF/UtEuguxEQfa30U3q+lEs3SBprvCK214QXS7fTazs7Im6
vNdyoqGAgGmN6HViybRHL2ZilaxYoQBdl7zimFgphlQ/Qa8p8zkBMv+mZp7wwrDn
kK/1RYlioJsw2bNEYTVTRPy/pBTDolNlkc0z2NZ21V5QObJRxLphrqaY8Yl5B7zV
W+TRDWV+dFcCjiMUxHrzkTWNBcBAlsjZo9bWXPhgxvygqfHzD7J7wbliVkEKLz8N
8nYga5KtlMUBN5IRoRtwOpVLUerfKxmbDvqzyMYR1mLGD3giVXzvGQX5jdaHSkSs
+3lEBXghVrAj0nXHq3r0XZawLi6bOwe9XDfOcSue2CblGlhOpknIvh2bY6gCF1Pt
BcfduhG1QSmL3dcCgkQkmOnqVVVKkraBdUpAZET3OhAsnD+Q/u1aW00TygLlEUh7
Msj4AxCSCqgS0xE/zzLbXwXfGV9RPbJ2LFz4zNuz54mOnUmWD5qd9Yzl2ezyG5c0
w5FWdjlxWPJmJovQEfAOuUJ5UyhjPVMnaTd9W1occNWgHwFk931NRMG/HrG13yWj
oPj2e7HcDrS5guh+m56S6HuZG8lw3nGhT6KyhxfF+TByCYLNMkg=
=C22B
-----END PGP SIGNATURE-----
Oliver Pinter (1):
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
Oliver Pinter + (50):
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
- Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master
Shawn Webb (3):
- HBSD: Disable cfi-icall for NFS RPC utilities
- HBSD: Disable cfi-icall for mount_nfs and showmount
- HBSD: Add EFIRT to the HARDENEDBSD amd64 kernel
ae (2):
- MFC r341471: Reimplement how net.inet.ip.fw.dyn_keep_states works.
- MFC r341472: Add ability to request listing and deleting only for dynamic states.
araujo (1):
- MFC r343077:
avg (1):
- MFC r342170: add support for marking interrupt handlers as suspended
avos (24):
- MFC r343088: rtwn_usb(4): add new USB id for RTL8821AU
- MFC r342991: net80211: provide rate validation for injected frames.
- MFC r343092: rtwn(4): clear 'basic' rate bit before calculating RTS/CTS rate.
- MFC r343190: net80211: drop m_pullup call from ieee80211_crypto_decap.
- MFC r343244: devd.conf(5): add otus(4) into wifi-driver-regex
- MFC r343249: Fix duplicate wpa_supplicant(8) / hostapd(8) startup with devd(8)
- MFC r343213: net80211: resolve ioctl <-> detach race for ieee80211com structure
- MFC r343341: ifconfig: drop unused macros from ifieee80211.c
- MFC r343235: iwn(4): drop return code from iwn_*attach functions (they cannot fail)
- MFC r343340: net80211: fix channel list construction for non-auto operating mode.
- MFC r343342: net80211: turn channel mode check into assertion.
- MFC r343234: run(4): add more length checks in Rx path.
- MFC r343238: urtw(4): add length checks in Rx path.
- MFC r343472: otus(4): fix a typo in man page (802.11 -> 802.11n)
- MFC r343473: geom_uzip(4): move NULL pointer KASSERT check before it is dereferenced
- MFC r343495: wlan.4: improve wording
- MFC r343497: Unbreak devd.conf(5) regex after r343249
- MFC r343496: pcf(4): fix parentheses in if condition
- MFC r343499: rc(8): do not stop dhclient(8) when wpa_supplicant(8) / hostapd(8) is used
- MFC r343518: rtwn_usb(4): add new USB id.
- MFC r343502: Remove RADIUS-related files when WITHOUT_RADIUS_SUPPORT=true is set in src.conf(5)
- MFC r343576: ndiscvt(8): abort if no IDs were found during conversion.
- MFC r343524: rsu(4): do not ignore mgmtrate / mcastrate / ucastrate.
- MFC r343541: Drop some unneeded includes from wireless USB drivers.
bapt (1):
- MFC: 343546
bcr (2):
- Add ZFS usage tips to freebsd-tips.
- MFC r343532: A few corrections and clarifications to r343406.
brooks (7):
- MFC r343162:
- MFC r343305:
- MFC r343366:
- MFC r340242:
- MFC r340129, r340195, r340198
- Regen after r343596: enable ppoll in capability mode.
- MFC r343587:
cy (5):
- MFC r343073:
- MFC r343103:
- MFC r343486:
- MFC r343600:
- MFC r342815:
delphij (4):
- MFC r342845,342846: Port NetBSD improvements:
- MFC r342856: Added support for the SIOCGI2C ioctl.
- MFC r343038: Use TD_IS_IDLETHREAD instead of unrolled version.
- MFC r342813: Remove unneeded headers.
emaste (3):
- MFC r343153: freebsd-update.8: mandoc -Tlint fixes
- MFC linuxulator stack memory disclosure fixes
- MFC r339960 (cem): freebsd-update: add a progress report
gallatin (2):
- MFC r341095:
- MFC r343430
gjb (1):
- MFC r343259: Correct a typo: was -> way.
gonzo (18):
- MFC r343450:
- MFC r343443, r343446, r343448, r343452
- MFC r343028, r343104
- MFC r343009, r343109-r343110, r343128, r343232
- MFC r343222-r343223, r343338
- MFC r343008:
- MFC r343029:
- MFC r343060:
- MFC r343069:
- MFC r343106:
- MFC r343127:
- MFC r343129:
- MFC r343156:
- MFC r343224, r343533
- MFC r343170:
- MFC r343391:
- MFC r343458:
- MFC r343516:
hselasky (7):
- MFC r343392: Fix duplicate acquiring of refcount when joining IPv6 multicast groups. This was observed by starting and stopping rpcbind(8) multiple times.
- MFC r343393: Add debugging sysctl to disable incoming MLD v2 messages similar to the existing sysctl for MLD v1 messages.
- MFC r343394: When detaching a network interface drain the workqueue freeing the inm's because the destructor will access the if_ioctl() callback in the ifnet pointer which is about to be freed. This prevents use-after-free.
- MFC r343395: Fix refcounting leaks in IPv6 MLD code leading to loss of IPv6 connectivity.
- Build fix for missing NET_EPOCH_XXX() dependencies after r343650. This patch is to be reverted when the relevant changes are MFC'ed. This is a direct commit.
- MFC r343451: Add full support for PCI_ANY_ID when matching PCI IDs in the LinuxKPI.
- MFC r343453: Add new USB quirk.
jah (1):
- MFC r343005: Handle SIGIO for listening sockets
jhibbits (3):
- MFC r342988:
- MFC r341387:
- MFC r342671:
jilles (1):
- MFC r343105: libedit: Avoid out of bounds read in 'bind' command
kevans (2):
- MFC r342903, r342911: libbe(3)/bectl(8) refactor and fix mount for deep BEs
- MFC r342757: getopt_long(3): fix case of malformed long opt
kib (17):
- MFC r343108: Trim whitespace at EoL, use tabs instead of spaces for indent.
- MFC r343017: Handle overflow in calculating max kmem size.
- MFC r343081: Trim spaces at the end of lines.
- MFC r343082: Implement shmat(2) flag SHM_REMAP.
- MFC r343085: Improve iflib busdma(9) KPI use.
- MFC r343086: Remove unused prototype.
- MFC r343087: Style(9) fixes for x86/busdma_bounce.c.
- MFC r343302: Remove unused *_sysinit_flags() declarations.
- MFC r339461: nvdimm(4): Fix GCC 6.4.0 build
- MFC r343143: nvdimm: add a driver for the NVDIMM root device
- MFC r343144: nvdimm: initialize SPA uuids statically.
- MFC r343145: MI VM: Make it possible to set size of superpage at boot instead of compile time.
- MFC r343146: x86 busdma: fix mis-use of bus_addr_t where vm_paddr_t is assumed.
- MFC r343147: i386/PAE busdma: allow more bounce pages.
- MFC r343484: Remove now redundand ifunc relocation code which should have been removed as part of r341441.
- MFC r343607: Reserve a bit in the FreeBSD feature control note for marking the image as not compatible with ASLR.
- MFC r343780: amd64: clear callee-preserved registers on syscall exit.
kp (7):
- MFC r342989
- MFC r342990
- MFC r343130
- MFC r343041
- MFC r343295:
- MFC r343297:
- MFC r343418:
marius (2):
- MFC: r342634
- MFC: r343481
markj (12):
- MFC r343117: Fix handling of rights on stdio streams.
- MFC r343245: Revert r343117.
- Properly commit the revert of r343205.
- MFC r342864: Specify the correct option level when emulating SO_PEERCRED.
- MFC r343265: hwpmc: Plug memory disclosures from PMC_OP_{GETPMCINFO,GETCPUINFO}.
- MFC r343286: nfs: Zero the buffers exported by NFSSVC_DUMPCLIENTS and DUMPLOCKS.
- MFC r343348: ocs_fc: Ensure that we zero-initialize memory before copying it out.
- MFC r343363, r343364: Fix an LLE lookup race.
- MFC r343274, r343275: Optimize RISC-V copyin(9)/copyout(9) routines.
- MFC r343247: Fix cmp(1) tests for "special" mode.
- MFC r343353: Correct uma_prealloc()'s use of domainset iterators after r339925.
- MFC r343784: Avoid leaking fp references when truncating SCM_RIGHTS control messages.
mav (6):
- MFC r342977 (by cem): amdtemp(4): Add support for Family 15h, Model >=60h
- MFC r342399: Remove CAM SIM lock from NVMe SIM.
- Increase MTX_POOL_SLEEP_SIZE from 128 to 1024.
- MFC r342546: Add descriptions to NVMe interrupts.
- MFC r342558: Switch from mutexes to atomics in GEOM_DEV I/O path.
- MFC r342557, r342559: Reimplement nvd(4) detach handling.
mckusick (1):
- MFC of 343449 and 343483
mw (1):
- MFC r343074: Suppress excessive error prints in ENA TX hotpath
np (1):
- MFC r342603: cxgbe(4): Attach to two T540 variants.
nyan (2):
- MFC: r342964
- MFC: r342965
pfg (3):
- MFC r343023: msun: reduce diff between src/e_j0.c and src/e_j0f.c
- MFC r343459: ext2fs: Add some extra consistency checks for the superblock.
- MFC r342379, r342383: gai_strerror() - Update string error messages according to RFC 3493.
sef (1):
- MFC r342928: Change ZFS quotas to return EINVAL when not present (matches man page).
shurd (1):
- MFC r343047:
tsoome (3):
- MFC r343123: loader should ignore active multi_vdev_crash_dump feature on zpool
- MFC r343124:
- MFC r343225: Unbreak mip64 build after r328437
tuexen (3):
- MFC r342857:
- MFC r342879:
- MFC r343089:
vmaffione (2):
- MFC r343413
- MFC r343552
wulf (3):
- MFC r340338: wmt(4): Add PNP record so it could be picked by devd/devmatch. Fix uhid(4) conflict with blacklisting of multitouch HID-usages in uhid(4) probe handler.
- MFC r340912,r340913:
- MFC r340926: