opencrypto: Prune dead code now that crypto_dispatch never fails.

(riastradh)

opencrypto: crypto_dispatch never fails now.  Make it return void.

Same with crypto_kdispatch.

(riastradh)

opencrypto: Assert driver process routine returns 0 or ERESTART.

No other errors are allowed -- other errors must be transmitted by
crypto_done.  All drivers in tree (sun8i_crypto, glxsb, via_padlock,
mvcesa, mvxpsec, hifn, qat, ubsec, cryptosoft) have been audited for
this.

(riastradh)

opencrypto: Rip out EAGAIN logic when unregistering crypto drivers.

I'm pretty sure this never worked reliably based on code inspection,
and it's unlikely to have ever been tested because it only applies
when unregistering a driver -- but we have no crypto drivers for
removable devices, so it would only apply if we went out of our way
to trigger detach with drvctl.

Instead, just make the operation fail with ENODEV, and remove all the
callback logic to resubmit the request on EAGAIN.  (Maybe this should
be ENXIO, but crypto_kdispatch already does ENODEV.)

(riastradh)

opencrypto: Assert nonnull callback up front in crypto_dispatch.

Same with crypto_kdispatch.

Convert some dead branches downstream to assertions too.

(riastradh)

crypto(4): Nix dead code now that crypto_freesession never fails.

(riastradh)

opencrypto: Make crypto_freesession return void.

No callers use the return value.  It is not sensible to allow this to
fail.

(riastradh)

opencrypto: Make freesession callback return void.

No functional change intended: all drivers already return zero
unconditionally.

(riastradh)

crypto(4): crypto_freesession should never fail here.

It can only fail if we pass it an invalid sid, which the logic to
maintain the user sessions should not do.  So kassert error=0 here.

(riastradh)

netipsec: Nothing uses xf_zeroize return value.  Nix it.

(riastradh)

cryptosoft(4): Prune dead branches.  Assert session id validity.

(riastradh)

mvxpsec(4): Prune dead branches.  Assert session id validity.

(riastradh)

ubsec(4): Prune dead branches.  Assert session id validity.

(riastradh)

hifn(4): Prune dead branches.  Assert session id validity.

(riastradh)

mvcesa(4): Prune dead branches.  Assert session id validity.

(riastradh)

padlock(4): Prune dead branches.  Assert session id validity.

(riastradh)

glxsb(4): Prune dead branches.  Assert session id validity.

(riastradh)

padlock(4): Return zero, not error, if we've issued crypto_done.

(riastradh)

glxsb(4): Return zero, not error, if we've issued crypto_done.

(riastradh)

ubsec(4): Tidy up error branches of ubsec_process.

Make sure to return zero, not error, when we've already done
crypto_done and set crp_etype.

(riastradh)

ubsec(4): Assert crp_sid is valid.

If opencrypto passes a bad sid in, that's a bug in opencrypto that
needs to be fixed, not a user-triggered invalid input that we need to
fail gracefully on.

(riastradh)

hifn(4): Make ERESTART return more obvious.

(riastradh)

hifn(4): Nix dead code.  crp and callback are guaranteed nonnull.

(riastradh)

opencrypto: Assert crp_desc and crp_buf are nonnull.

- crypto_getreq ensures crp_desc is nonnull.
- Caller is responsible for setting crp_buf.

(riastradh)

crypto(4): Refuse crypto operations with nothing in them earlier.

This way we avoid passing 0 to crypto_getreq -- makes it easier to
reason about everything downstream.

(riastradh)

opencrypto: Assert num>0 in crypto_getreq, num=1 in crypto_kgetreq.

- For crypto_getreq this makes downstream reasoning easier: on
  success, crp_desc is guaranteed to be nonnull.

- For crypto_kgetreq, this was already assumed, just silently
  ignored and not checked by anything.

(riastradh)

hifn(4): hifn_compression always returns zero.  Prune dead branches.

(riastradh)

hifn(4): Fix error branches to do crypto_done, not return error.

(riastradh)

ubsec(4): ubsec_kprocess always returns zero.  Prune dead branches.

(riastradh)

ubsec(4): Fix error branch: call crypto_kdone, don't return error.

(riastradh)

opencrypto: Make crp_callback, krp_callback return void.

Nothing uses the return values inside opencrypto, so let's stop
making users return them.

(riastradh)

opencrypto: Nix CRYPTO_F_DONE.

Nothing uses it any more.

(riastradh)

crypto(4): Fix possible use-after-free in race around detach.

This is extremely unlikely because I don't think we have any drivers
for removable crypto decelerators^Waccelerators...but if we were to
sprout one, and someone ran crypto_dispatch concurrently with
crypto_unregister, cryptodev_cb/mcb would enter with crp->crp_etype =
EAGAIN and with CRYPTO_F_DONE set in crp->crp_flags.  In this case,
cryptodev_cb/mcb would issue crypto_dispatch but -- since nothing
clears CRYPTO_F_DONE -- it would _also_ consider the request done and
notify the ioctl thread of that.

With this change, we return early if crypto_dispatch succeeds.  No
need to consult CRYPTO_F_DONE: if the callback is invoked it's done,
and if we try to redispatch it on EAGAIN but crypto_dispatch fails,
it's done.  (Soon we'll get rid of the possibility of crypto_dispatch
failing synchronously, but not just yet.)

XXX This path could really use some testing!

(riastradh)

cryptosoft(4): Rip out nonsense to quietly ignore sid=0.

This is no longer necessary because crypto_freesession no longer
calls into the driver for session ids that were never allocated in
the first place.

(riastradh)

fix various small typos, mainly in comments.

(andvar)

opencrypto: Make sid=0 always invalid, but OK to free.

Previously, crypto_newsession could sometimes return 0 as the
driver-specific part of the session id, and 0 as the hid, for sid=0.
But netipsec assumes that it is always safe to free sid=0 from
zero-initialized memory even if crypto_newsession has never
succeeded.  So it was up to every driver in tree to gracefully handle
sid=0, if it happened to get assigned hid=0.  And, as long as the
freesession callback was expected to just return an error code when
given a bogus session id, that worked out fine...because nothing ever
used the error code.

That was a terrible fragile system that should never have been
invented.  Instead, let's just ensure that valid session ids are
nonzero, and make crypto_freesession with sid=0 be a no-op.

(riastradh)

gomoku: document a missed immediate win

No binary change.

(rillig)

Note that binutils 2.38 has been released in February.

While there, switch home page to HTTPS.

(fcambus)

gomoku: extract main_game_loop from main

No functional change.

(rillig)

Use PRIxBUSADDR for bus_addr_t in debug printf.

Kernel i386/ALL compiles again.

(hannken)

gomoku: turn comments for testing mode into actual code

No functional change.

(rillig)

gomoku: extract read_color from main

No functional change.

(rillig)

gomoku: extract declare_winner from main

(rillig)

gomoku: extract ask_user_color from main

No functional change.

(rillig)

gomoku: extract read_move from main

No functional change.

(rillig)

gomoku: extract set_input_sources from main

No functional change.

(rillig)

gomoku: extract parse_args from main

No functional change.

(rillig)

gomoku: extract save_game from main

No functional change.

(rillig)

usbhid.3: hid_parse_usage_in_page() actually returns int

(charlotte)

regen

(charlotte)

usbdevs: Add Wacom "One" CTL-671 tablet

(charlotte)

rename CONFIG_AARCH64 to CONFIG_ARM64 which is what upstream code expects

(tnn)

drm_cache.h: fix a merge error

this reverts revision 1.3 which should have been reverted when it got
introduced by upstream through revision 1.5.

(tnn)

crypto(4): Fix set-but-unused variable warning.

This deliberately ignores the error code returned by crypto_dispatch,
but that error code is fundamentally incoherent and the issue will be
mooted by subsequent changes to make it return void and always pass
the error through the callback, as well as subsequent changes to rip
out the EAGAIN logic anyway.

(riastradh)

tests/crypto/opencrypto: Wait a bit for async results.

These may not be ready immediately.

(riastradh)

crypto(4): Don't signal the condvar for multi-operation completion.

The condvar may be destroyed by the time we got here, and nothing
waits on it anyway -- instead the caller is expected to select/poll
for completion in userland.

The bug was already here, but the recent change to eliminate
CRYPTO_F_CBIMM made it happen more often by causing the callback to
_always_ be run asynchronously instead of sometimes being run
synchronously.

(riastradh)

argon2: Silence -Wmissing-noreturn in thread.c on clang.

Saves the trouble of patching it away in external code.

(riastradh)

s/artifical/artificial/ in comments.

(andvar)

gomoku: fix error handling when reading moves from a file

The columns of the board are labeled from A to H and J to T, which makes
I5 or i5 an invalid coordinate.  Previously, reading this invalid
coordinate from a file resulted in the string "<6" appearing in the move
log.

The 'i' was converted into the nonexistent column 20, and PT(20, 5) got
an out-of-bounds argument, resulting in spot 120.  Converting this spot
back into coordinates resulted in PT(0, 6).  The '<' comes from
'letters[0]'.

(rillig)

drm: Nix driver-specific DRM_FILE_PAGE_OFFSET defs and tests.

This was consolidated upstream into the vma manager.

PR kern/56812

(riastradh)

gomoku: right-align column header for move number

(rillig)

gomoku: provide readable names for c.a and c.b

No binary change.

(rillig)

gomoku: move comments closer to their corresponding entities

No binary change.

(rillig)

gomoku: inline macro MAXCOMBO

The name of the macro was not descriptive enough, the other constants in
bdinit also don't have names.

No binary change.

(rillig)

doc/CHANGES: Expand notes on vether(4) and tap(4).

(riastradh)

doc/CHANGES: Nix trailing whitespace.

(riastradh)

gomoku: convert input source constants to an enum

I also tried converting other macros, but s_occ would use more memory
and the return values for makemove are special values, besides the usual
coordinates in the form PT(x, y), so turning the special values into an
enum would be confusing.

No functional change.

(rillig)

gomoku: shorten code, error out on too many arguments

(rillig)

opencrypto/h_ioctl: Print error messages with warn.

Might help track down what's going on when this fails.

(riastradh)

curses_input.3: wtimeout() returns void too

(uwe)

gomoku: warn before overwriting a saved game file

(rillig)

gomoku: do not accept overly long lines from the input

Typing beyond the screen and then pressing and holding backspace still
removes the prompt, just as before.

(rillig)

gomoku: fix deleting a character when reading a line

(rillig)

Correct byte-order for bufsize field of RX descriptor.

XXX
This bug affected only armeb. Unfortunately, the systems including
armel still lock up eventually with NFS root on mvgbe(4)...

(rin)

m_freem() *after* bus_dmamap_sync() and bus_dmamap_load() for
that mbuf. This is mandatory for some archs.

(rin)

Add DPRINTF() to catch failure of m_defrag() in mvgbe_encap().

(rin)

Raise threshold of debug level to 3 for DPRINTF() in non-error path of
mvgbe_encap(). Without this change, debug level 2 is almost unusable...

(rin)

gomoku: prevent thinking for too long

At search depth 9, picking a move takes about a minute on modern
hardware, which is enough for casual game play.  Even then, gomoku does
not always find the perfect move, so investing that much time seems
questionable.  Limiting the search depth also puts an upper bound on the
memory usage, which is quite high with 150 MB.

(rillig)

gomoku: in debug mode, after pressing 'd', allow another debug command

While here, remove the sleeping, as there is no obvious reason for it.

(rillig)

gomoku: make drawing the player's names simpler

No functional change.

(rillig)

curses_input.3: timeout() actually returns void

(charlotte)

fix typo in sigaction(2)

(dholland)

s/appropiate/appropriate/ in comments and readme file.

(andvar)

lint: use __RCSID in lint mode as well

Since 1995-10-02, lint supports __asm statements and __asm modifiers.

No binary change.

(rillig)

tests/lint: sync comment with reality

(rillig)

s/auxillary/auxiliary/ in comments.

(andvar)

gomoku: fix spelling and grammar in comments

(rillig)

Build OPENBLOCKS_A6 kernel for evbarmv5-e[bl].

It works --- except for:

- mvsata(4) problems (already reported repeatedly)
- NFS root with mvgbe(4) is weird; the system eventually locks up

Yes, we need to fix them...

(rin)

Hmm, fix typo in comments again...

(rin)

Fix typo for the previous. No binary changes.

(rin)

Initial support for armv5eb on Sheeva.

Disable L2 cache for Sheeva before switch to big-endian mode.

Note that we need to encode this code sequence in little endian,
as u-boot starts kernel in little-endian mode.

XXX
At the moment, this code is unconditionally enabled if CPU_SHEEVA
option is enabled; it does not work for older CPUs.

It would be better to determine CPU type automatically as done for
little-endian variant, but it is too ugly to hand-assemble for
the opposite byte-order.

It may be nice if we have tools something like:

$ nbarm-elf-bswap -s marvell_start -e Lswitch_endian_done netbsd

Tested for OPENBLOCKS_A6 (for CPU_SHEEVA), as well as KUROBOX_PRO
(for !CPU_SHEEVA).

(rin)

Comment out most of USB devices. Fix boot failure since netbsd-8.

There is an upper limit of kernel size for u-boot, somewhere at ~6MB.
If kernel exceeds this limit, work area of u-boot gets broken.

(rin)

Improve Hyper-V support.

vmbus(4):
- Added support for multichannel.

hvn(4):
- Added support for multichannel.
- Added support for change MTU.
- Added support for TX aggregation.
- Improve VLAN support.
- Improve checksum offload support.

(nonaka)

fix some misspellings and remove trailing whitespaces.

(andvar)

Add the character read in as part of imxuart_common_putc into the
readahead buffer

port-arm/45354: no character is put in the read-ahead buffer in a console code of arch/arm/imx/imxuart.c

(skrll)

Use a macro.  Part of

port-arm/45354: no character is put in the read-ahead buffer in a console code of arch/arm/imx/imxuart.c

(skrll)

gomoku: remove unused function 'list_eq'

(rillig)

gomoku: use combined curses functions

To save some screen space in the source code and some bytes in the
generated binary.

No functional change.

(rillig)

gomoku: use NULL instead of more verbose null pointer

No binary change.

(rillig)

gomoku: clean up coordinate for the currently selected spot

There is no need to make this coordinate dependent on the board size.

No binary change.

(rillig)

gomoku: clean up version control sections

Lint can handle these definitions, and the '#if 0' is redundant.

No functional change.

(rillig)

opencrypto: Assert !cpu_intr_p() on dispatch and invoke.

These should only ever have been potentially called from hard
interrupt context by CRYPTO_F_CBIMM callbacks (CBIMM = call back
immediately).  CRYPTO_F_CBIMM is no more, so there is no more need to
allow this case of call from hard interrupt context.

(riastradh)

opencrypto: Nix CRYPTO_F_USER, CRYPTO_F_CBIMM, CRYPTO_F_CBIFSYNC.

CRYPTO_F_USER is no longer needed.  It was introduced in 2008 by
darran@ in crypto.c 1.30, cryptodev.c 1.45 in an attempt to avoid
double-free between the issuing thread and asynchronous callback.
But the `fix' didn't work.  In 2017, knakahara@ fixed it properly in
cryptodev.c 1.87 by distinguishing `the crypto operation has
completed' (CRYPTO_F_DONE) from `the callback is done touching the
crp object' (CRYPTO_F_DQRETQ, now renamed to CRYPTODEV_F_RET).

CRYPTO_F_CBIMM formerly served to invoke the callback synchronously
from the driver's interrupt completion routine, to reduce contention
on what was once a single cryptoret thread.  Now, there is a per-CPU
queue and softint for much cheaper processing, so there is less
motivation for this in the first place.  So let's remove the
complicated logic.  This means the callbacks never run in hard
interrupt context, which means we don't need to worry about recursion
into crypto_dispatch in hard interrupt context.

(riastradh)

gomoku: remove unreachable code at the end of main

In C99 mode, lint accepts when control gets to the end of main without
returning a value.  It does not know anything about __dead though.

No binary change.

(rillig)

gomoku: replace magic numbers with proper coordinate calculation

(rillig)

PR/56840: Andrew Cagney: use the proper polarity hton/ntoh macros (no
functional change).
Factor out spi retrieving code into a function.

(christos)

gomoku: properly center the player's names

(rillig)

gomoku: de-obfuscate screen coordinate calculation

Modern compilers optimize linear integer arithmetic, so there is no
reason to use strange or misleading formulas.

Replace several magic numbers with proper formulas.

No binary change.

(rillig)

lint: in strict bool mode, check function arguments more strictly

When a system header defined the constant FALSE = 0, that constant could
be passed as a bool argument.  On the other hand, the constant TRUE = 1
could not be passed in the same way.  Remove this inconsistency.

(rillig)

tests/lint: extend tests for type mismatch in strict bool mode

Seen in games/gomoku when calling curses functions.

(rillig)

gomoku: fix error message for small screen

- gomoku: Screen too small (need 8018d)
+ gomoku: Screen too small (need 80x24)

(rillig)

gomoku: fix type mismatch in call to curses function

Not yet detected by lint, as lint is more permissive for type mismatches
if the value is a constant 0.  Being permissive doesn't make sense in
this case.  Now the calls to 'keypad' and 'leaveok' are consistent.

No binary change.

(rillig)

Ticket #1456

(martin)

Pull up following revision(s) (requested by buhrow in ticket #1456):

sys/dev/pci/if_bge.c: revision 1.353

For chips which contain an ASF/IPMI firmware, instruct the chip to shut
the host ASF firmware down when attaching the device so the IPMI BMC
can use the same physical port even when NetBSD doesn't have a
network configuration on the device.
By contrast, when the device gets a network configuration assigned to
it and bge_init() is called, the host ASF firmware is brought up so
both NetBSD and the IPMI BMc can use the same physical port.

This now matches FreeBSD behavior, as well as  behavior from NetBSD-5.2.

Tested on a Sunfire X2200-M2 system with the following chip:

bge1 at pci7 dev 4 function 1: Broadcom BCM5715 Gigabit Ethernet
bge1: interrupting at ioapic0 pin 11
bge1: HW config 000000d4, 00000014, 00000000, 00000000 00000000
bge1: ASIC BCM5715 A3 (0x9003), Ethernet address 00:1e:68:XX:XX:XX
bge1: setting short Tx thresholds
brgphy1 at bge1 phy 1: BCM5714 1000BASE-T/X media interface, rev. 0
brgphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FDX, auto

(martin)

Bump some column widths for "vmstat -mW".

(simonb)

Restore de EOI mechanism for pirq, using the newer hypervisor interface.
It is needed.
Hopefully fixes kern/56291, kern/56793, kern/55667

(bouyer)

Set the last change pointer after adding a character at the bottom right
of a window.  This fixes the character missing in the LR of a window.
Thanks to uwe@ for pointing this out.

(blymn)

Use RAS_{START,END}_ASM_HIDDEN

(skrll)

port-hppa/56837: RAS support is slightly incorrect within hppa kernel, too

While there isn't a bug here (the tf_iioq_tail handling is correct) apply
the change to make the conditional / ras symbols consistent with hppa_ras

(skrll)

For chips which contain an ASF/IPMI firmware, instruct the chip to shut the host ASF firmware
down when attaching the device so the IPMI BMC can use the same physical port even when NetBSD
doesn't have a network configuration on the device.  By contrast, when the device gets a
network configuration assigned to it and bge_init() is called, the host ASF firmware is brought
up so both NetBSD and the IPMI BMc can use the same
physical port.

This now matches FreeBSD behavior, as well as  behavior from NetBSD-5.2.

Tested on a Sunfire X2200-M2 system with the following chip:

bge1 at pci7 dev 4 function 1: Broadcom BCM5715 Gigabit Ethernet
bge1: interrupting at ioapic0 pin 11
bge1: HW config 000000d4, 00000014, 00000000, 00000000 00000000
bge1: ASIC BCM5715 A3 (0x9003), Ethernet address 00:1e:68:XX:XX:XX
bge1: setting short Tx thresholds
brgphy1 at bge1 phy 1: BCM5714 1000BASE-T/X media interface, rev. 0
brgphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FDX, auto

(buhrow)

apropos(1): improve error handling in edge cases

Patch from RVP on NetBSD-Users, with an additional comment tweak by me.
Summary from RVP:

1. Ignore SIGPIPE so that we're not killed in the middle of some
  DB operation by a botched $PAGER:

$ env PAGER=/non-existent apropos -p ...

2. Return proper exit status in case of write errors:

$ apropos ... >/dev/full || echo fail

(gutteridge)

Regen for real

(charlotte)

Regen

(charlotte)

usbdevs: Add Xbox 360 controller

(charlotte)

Don't set the more flag when there is no packet to process.

Move the location of the loop limit check next to the DD bit test. This
change prevent from scheduling the next txrx_work that does nothing.

(msaitoh)

Call wm_xxeof() only when limit > 0.

It's not required to call wm_xxeof() when limit == 0. It means that
all xxeof processing will be done by softint or workqueue. Currently,
wm_xxeof() returns quickly before checking the descriptor head when
limit == 0 and return with ture to set the more flag.

(msaitoh)

gomoku: reduce scope of local variables

No binary change.

(rillig)

gomoku: reduce scope of 'for' loop variables

No binary change.

(rillig)

gomoku: rename local variable

Not every array of "characters" is a string.  In this case, it's rather
an array of bool.

No binary change.

(rillig)

lint: do not warn about '==' on the right-hand side of ','

(rillig)

crypto(4): Simplify error test in cryptodev_op.

No functional change intended.

(riastradh)

crypto(4): Narrow scope of cryptodev_mtx to cover wait.

No functional change intended -- this only removes an unnecessary
lock/unlock cycle in the error case.

(riastradh)

crypto(4): Nix long-dead code and comments.

(riastradh)

crypto(4): Use IPL_NONE, not IPL_NET, for /dev/crypto pools.

These are used (pool_get/put) only from thread context, never from
interrupt or even soft interrupt context.

(riastradh)

lint: reduce negations in typeok_point, document check_expr_misc

No functional change.

(rillig)

gomoku: call setprogname, for portability

No functional change on NetBSD, but the games are distributed to other
platforms as well.

(rillig)

tests/lint: add more examples for warning in comma expression

(rillig)

When not invoked via some explicit "configure network" menu item,
auto-detect an already working network setup and offer to "just use" it
whenver we need connectivity.

(martin)

PR/56841: Andrew Cagney: debug-log IPcomp CPI lookups:
    - debug-logs why an SPI is rejected
    - adds missing __VA_OPT__(,) to some printf macros
    - debug-log SPI+proto when adding/updating entry

(christos)

fix typos in word "access" and it derivatives, mainly in comments.

(andvar)

s/yhe/the/

(andvar)

s/yeild/yield/

(andvar)

ubsec(4): Nix dead code.

No functional change intended.

(riastradh)

call this bozohttpd 20220517.

(mrg)

Use the Makefile.inc from libargon2 (fixes the vax build that requires
a compiler hack).

(christos)

Move guts of the Makefile into Makefile.inc so it can be re-used.

(christos)

cprng(9): Note ipl must be at most IPL_SOFTSERIAL now.

(riastradh)

Ticket #1453

(martin)

Pull up following revision(s) (requested by skrll in ticket #1453):

common/lib/libc/atomic/atomic_c11_compare_exchange_cas_32.c: revision 1.5

Fix the copy&paste botch from previous.  Spotted by Tom Lane.

(martin)

Ticket 1743

(bouyer)

Pull up following revision(s) (requested by kre in ticket #1743):
libexec/mail.local/mail.local.c: revision 1.29
fix local privilege escalation due to a race condition
NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).
mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).
An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.
Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).
Thanks to Jan Schaumann for bringing this to our attention.

(bouyer)

Ticket 1455

(bouyer)

Pull up following revision(s) (requested by kre in ticket #1455):
libexec/mail.local/mail.local.c: revision 1.29
fix local privilege escalation due to a race condition
NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).
mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).
An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.
Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).
Thanks to Jan Schaumann for bringing this to our attention.

(bouyer)

MAKEDEV.tmpl: make /dev/wsfont world-readable

Now that we have WSDISPLAYIO_LISTFONTS we want users to be able to use it.

NB: older kernels didn't check that WSDISPLAYIO_LDFONT was performed
on wsfont(4) device opened for writing and relied on its restrictive
root-only permissions to restrict who can load fonts.

(uwe)

apropos(1): Use the official spelling for "SQLite".

While here, use .Bx to refer to 3BSD.

(uwe)

apropos(1): Tweak the description of -1, ... -9, and -s

-s is not for compatibility only, because section names can be
anything.  E.g. we have 3lua and 9lua in base.  We have rudiments of
3f (for FORTRAN libs).  Some packages in pkgsrc also use suffixed 1
and 3 sections.

(uwe)

fix local privilege escalation due to a race condition

NetBSD-SA2016-006 included an incomplete fix for CVE-2016-6253,
a local privilege escalation vulnerability in mail.local(8).

mail.local(8) attempts to open(2) a user's existing mailbox file
to append to it.  If that call fails, mail.local(8) will then issue
a second open(2) call to create the file (O_CREAT).

An attacker had the opportunity to create the file in question (as
a symlink, or link to some other file) in between these two open(2) calls.

Fix this by using O_EXCL in the 2nd open call, if the file exists when
that one happens, something is going wrong, so just abort.  Also, only
attempt that 2nd open if the reason the first failed was that the file
did not exist (this doesn't fix the issue, but it potentially saves
some cycles).

Thanks to Jan Schaumann for bringing this to our attention.

(kre)

ticket 1742

(bouyer)