Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit for releng/12.2)

Fix ftpd privilege escalation via ftpchroot.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:30.ftpd
Security: CVE-2020-7468

Fix bhyve SVM guest escape.

This actually has a patch to sys/amd64/vmm/amd/svm.c that was accidentally
committed as part of r365779.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:29.bhyve_svm
Security: CVE-2020-7467

Fix bhyve privilege escalation via VMCS access.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:28.bhyve_vmcs
Security: CVE-2020-24718

Fix ure device driver susceptible to packet-in-packet attack.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:27.ure
Security: CVE-2020-7464

Add UPDATING entries and bump version.

Approved by: so

Fix dhclient heap overflow.

Approved by: so
Security: FreeBSD-SA-20:26.dhclient
Security: CVE-2020-7461

Fix SCTP socket use-after-free.

Approved by: so
Security: FreeBSD-SA-20:25.sctp
Security: CVE-2020-7463

Fix IPv6 Hop-by-Hop options use-after-free.

Approved by: so
Security: FreeBSD-SA-20:24.ipv6
Security: CVE-2020-7462

Fix getfsstat compatibility system call panic.

Approved by: so
Security: FreeBSD-EN-20:18.getfsstat

Fix FreeBSD Linux ABI kernel panic.

Approved by: so
Security: FreeBSD-EN-20:17.linuxthread

Add UPDATING entries and bump version.

Approved by: so

Fix sendmsg(2) privilege escalation.

Approved by: so
Security: FreeBSD-SA-20:23.sendmsg
Security: CVE-2020-7460

Fix multiple vulnerabilities in sqlite3.

Approved by: so
Security: FreeBSD-SA-20:22.sqlite
Security: CVE-2020-11655
Security: CVE-2020-11656
Security: CVE-2020-13434
Security: CVE-2020-13435
Security: CVE-2020-13630
Security: CVE-2020-13631
Security: CVE-2020-13632

Fix memory corruption in USB network device drivers.

Approved by: so
Security: FreeBSD-SA-20:21.usb_net
Security: CVE-2020-7459

Add UPDATING entries and bump version.

Approved by: so

Fix multiple vulnerabilities in unbound.

Approved by: so
Security: FreeBSD-SA-20:19.unbound
Security: CVE-2020-12662
Security: CVE-2020-12663

Fix IPv6 socket option race condition and use after free.

Approved by: so
Security: FreeBSD-SA-20:20.ipv6
Security: CVE-2020-7457

Fix kernel panic in mps(4) driver.

Approved by: so
Security: FreeBSD-EN-20:15.mps

Fix kernel panic in LinuxKPI subsystem.

Approved by: so
Security: FreeBSD-EN-20:14.linuxpki

Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit)

Fix USB HID descriptor parsing error.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:17.usb
Security: CVE-2020-7456

Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit)

Fix use after free in cryptodev module.

Approved by: so
Security: FreeBSD-SA-20:15.cryptodev
Security: CVE-2019-15879

Fix improper checking in SCTP-AUTH shared key update.

Approved by: so
Security: FreeBSD-SA-20:14.sctp
Security: CVE-2019-15878

Fix memory disclosure vulnerability in libalias.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:13.libalias
Security: CVE-2020-7455

Fix insufficient packet length validation in libalias.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:12.libalias
Security: CVE-2020-7454

Update to tzdata 2020a.

Approved by: so
Security: EN-20:08.tzdata

MF11 r352638,r358076: correct Clang and lld version checks

r352638 (mhorne): Allow for compiler versions >= 10
r358076 (dim): Correctly recognize linker versions greater than 10.0.

These routines determine the host compiler and linker version, and caused
attempts to build 12.1-RELEASE on 13-CURRENT to fail after the latter was
updated to Clang 10.  The host compiler version was also misdetected on
11.3 although it seems not to have caused the same build failure there.

We don't guarantee such a build config to work, but it is used by FreeBSD
ports build processes.  As a result the fixes from stable/11 will be
included with the next set of advisories, and are being committed to the
releng branch now to unblock ports builds.

PR: 245973
Reported by: sbruno, antoine
Approved by: so
Errata: EN-20:10.build
Sponsored by: The FreeBSD Foundation

Add UPDATING entries and bump version.

Approved by: so

Fix ipfw invalid mbuf handling.

Approved by: so
Security: FreeBSD-SA-20:10.ipfw
Security: CVE-2019-5614
Security: CVE-2019-15874

Fix regression in rpc.rquotad with certain NFS servers.

Approved by: so
Security: FreeBSD-EN-20:07.quotad

Add UPDATING entries and bump version.

Approved by: so

Fix multiple denial of service in ntpd.

Approved by: so
Security: FreeBSD-SA-20:09.ntp

Fix kernel memory disclosure with nested jails.

Approved by: so
Security: FreeBSD-SA-20:08.jail
Security: CVE-2020-7453

Fix incorrect user-controlled pointer use in epair.

Approved by: so
Security: FreeBSD-SA-20:07.epair
Security: CVE-2020-7452

Fix insufficient oce(4) ioctl(2) privilege checking.

Approved by: so
Security: FreeBSD-SA-20:05.if_oce_ioctl
Security: CVE-2019-15876

Fix TCP IPv6 SYN cache kernel information disclosure.

Approved by: so
Security: FreeBSD-SA-20:04.tcp
Security: CVE-2020-7451

Fix incorrect checksum calculations with IPv6 extension headers.

Approved by: so
Security: FreeBSD-EN-20:06.ipv6

Fix missing pfctl(8) tunable.

Approved by: so
Security: FreeBSD-EN-20:04.pfctl

Add UPDATING entries and bump version.

Approved by: so

Fix kernel stack data disclosure

Reported by: Ilja Van Sprundel
Approved by: so
Security: FreeBSD-SA-20:03.thrmisc
Security: CVE-2019-15875

Fix libfetch buffer overflow

Reported by: Duncan Overbruck
Approved by: so
Security: FreeBSD-SA-20:01.libfetch
Security: CVE-2020-7450

Fix nmount invalid pointer dereference

Submitted by: Andrew Turner
Approved by: so
Security: FreeBSD-EN-20:02.nmount

Fix imprecise ordering of SSP canary initialization

Submitted by: Kyle Evans
Approved by: so
Security: FreeBSD-EN-20:01.ssp

Add UPDATING entries and bump version numbers.

Approved by: so

Fix Machine Check Exception on Page Size Change.

Approved by: so
Security: FreeBSD-SA-19:25.mcepsc
Security: CVE-2018-12207

Import tzdata 2019c.

Approved by: so
Security: FreeBSD-EN-19:18.tzdata

That's EN-19:17.ipfw. It's not an SA.

Reported by: kevans@
Approved by: so

Bump version information and add UPDATING entries.

Approved by: so

Fix reference count overflow in mqueuefs.

Approved by: so
Security: FreeBSD-SA-19:24.mqueuefs
Security: CVE-2019-5603

Fix kernel memory disclosure from /dev/midistat.

Approved by: so
Security: FreeBSD-SA-19:23.midi
Security: CVE-2019-5612

Fix IPv6 remote denial of service.

Approved by: so
Security: FreeBSD-SA-19:22.mbuf
Security: CVE-2019-5611

Fix ipfw(8) jail keyword prior to jail startup.

Approved by: so
Security: FreeBSD-EN-19:17.ipfw

Add bhyve instruction emulation improvements (opcode 03H and F7H).

Approved by: so
Security: FreeBSD-EN-19:16.bhyve

Bump version information and add UPDATING entries.

Approved by: so

Fix insufficient validation of guest-supplied data (e1000 device).

Approved by: so
Security: FreeBSD-SA-19:21.bhyve
Security: CVE-2019-5609

Fix insufficient message length validation in bsnmp library.

Approved by: so
Security: FreeBSD-SA-19:20.bsnmp
Security: CVE-2019-5610

Fix ICMPv6 / MLDv2 out-of-bounds memory access.

Approved by: so
Security: FreeBSD-SA-19:19.mldv2
Security: CVE-2019-5608

Fix multiple vulnerabilities in bzip2.

Approved by: so
Security: FreeBSD-SA-19:18.bzip2
Security: CVE-2016-3189
Security: CVE-2019-12900

Bump version information and update UPDATING.

Approved by: so

Fix file descriptor reference count leak.

Approved by: so
Security: FreeBSD-SA-19:17.fd
Security: CVE-2019-5607

Fix byhve out-of-bounds read in XHCI device.

Approved by: so
Security: FreeBSD-SA-19:16.bhyve
Security: CVE-2019-5604

Fix reference count overflow in mqueuefs.

Approved by: so
Security: FreeBSD-SA-19:15.mqueuefs
Security: CVE-2019-5603

Fix kernel memory disclosure in freebsd32_ioctl.

Approved by: so
Security: FreeBSD-SA-19:14.freebsd32
Security: CVE-2019-5605

Fix pts write-after-free.

Approved by: so
Security: FreeBSD-SA-19:13.pts
Security: CVE-2019-5606

Fix multiple telnet client vulnerabilities.

Approved by: so
Security: FreeBSD-SA-19:12.telnet
Security: CVE-2019-0053

Fix panic from Intel CPU vulnerability mitigation.

Approved by: so
Security: FreeBSD-EN-19:13.mds

- Switch releng/11.3 to -RELEASE.
- Add the anticipated 11.3-RELEASE date to UPDATING.
- Set a static __FreeBSD_version.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document three open issues affecting 11.3-RELEASE.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document SA-19:09, SA-19:11.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document r349620, tzdata 2019b.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Update UPDATING and bump newvers.sh

Approved by: so
Approved by: re (implicit)

Fix privilege escalation in cd(4) driver.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-19:11.cd_ioctl
Security: CVE-2019-5602

Fix iconv buffer overflow.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-19:09.iconv

Import tzdata 2019b.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-EN-19:12.tzdata

Update releng/11.3 to RC3 as part of the 11.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

MFC r349376: Fix strsep_quote() on strings without quotes.

For strings without quotes and escapes dstptr and srcptr are equal, so
zeroing *dstptr before checking *srcptr is not a good idea.  In practice
it means that in -maproot=65534:65533 everything after the colon is lost.

The problem was there since r293305, but before r346976 it was covered by
improper strsep_quote() usage.

PR: 238725

Approved by: re (gjb)

Merge from stable/11:
  Fix the uninitialized use of source IPv6 address in NAT64LSN.

  This code is already refactored in head/, but due to the missing
  epoch(9) support it is impossible to merge. So, it is direct commit to
  stable/11.

  Reported by: Patrick M. Hausen <hausen punkt de>
  Tested by: Patrick M. Hausen <hausen punkt de>
Approved by: re (kib, gjb)

Bump the release.manpath.freebsd macro version, although I do not
see any place this is actually used.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Connect the installation page to the build.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- Update version numbers in the installation page.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- Add versions of ports-mgmt/pkg, x11/gnome3, and x11/kde5.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- Remove empty sections.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- r338938, oce(4) version 11.0.50.0.
- r341987, mlx4en(4) and mlx5en(4) version 3.5.0.
- r349181, ixl(4) and ixlv(4) version 1.11.9 and 1.5.8.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- r347037, virtual machine image reduction, and note how to resize
           the images.
- r346479, init_exec kenv(1) variable addition.
- r346518, spi(8) addition.
- r348482, deprecated IPSec algorithm warnings.
- r347962, driver deprecations.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Update releng/11.3 to RC2 as part of the 11.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Update the pkg.conf used to populate the dvd1.iso to use
the release_3 package set.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFS r349163: ixl(4)/ixlv(4): Update Intel XL710 PF and VF drivers to ixl-1.11.9 and ixlv-1.5.8

Update the legacy (non-iflib) drivers in stable/11 with recent changes from the
Intel out-of-tree version.

Major changes:

- Support for new BASE-T device with additional link speeds (2.5G and 5G) and EEE
- Additional I2C access methods backported from ixl-iflib
- FW LLDP Agent control with sysctl added for X722 devices (this already
  existed for 710 devices)
- MAC/VLAN filters handling has been refactored
- Building and loading if_ixlv as a KLD has been fixed

This commit is not from CURRENT since the driver in 12/13 uses iflib, and the decision was
made to not use iflib in FreeBSD 11 releases.

Submitted by: Krzysztof Galazka <krzysztof.galazka@intel.com>
Approved by: re@ (gjb@)
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D20290

Post-branch updates to release-related documentation:

- Bump copyright years.
- Note in parenthesis 11.3 may be the last 11.x release.
- Prune stale errata items from 11.2-RELEASE.
- Fix mailing list in the readme page.
- Bump version numbers accordingly.

This has no effect or impact on the in-progress 11.3-RC1
build.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy stable/11@r349022 to releng/11.3 as part of the 11.3-RELEASE
cycle.
Update releng/11.3 from BETA3 to RC1.
Switch the default dvd1.iso pkg(8) repository from latest to
quarterly.
Bump __FreeBSD_version.
Prune vestigial svn:mergeinfo from the new branch.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Release notes documentation:
- r346296, clang (and friends) 8.0.0.
- r346981, WPA 2.8.
- r348343, OpenSSL 1.0.2s.
- r348607, libarchive(3) updates.
- r348980, OpenPAM updates.
- r346855, cxgbe(4) hash filters, NAT offloading, SMAC/DMAC
           swapping filtering.
- r346940, cxgbe(4) T4/5/6 firmware update.
- r348588, geli(8) weak algorithm deprecation warnings.
- r346690, ZFS parallel mounting.
- r348753, deprecation warnings enabled.
- r346212, NAT64 CLAT support.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC r348682:
  Initialize V_nat64out methods explicitly.

  It looks like initialization of static variable doesn't work for
  VIMAGE and this leads to panic.

Approved by: re (gjb)

MFH (r313975, r315909, r317827, r344533): upgrade to latest OpenPAM

Approved by: re (gjb)

MFC r348797:
Fix for reading the configuration descriptor in libusb. Catch invalid
configuration descriptor reads early on to avoid issues with devices
that don't check for a valid USB configuration read request.

Submitted by: takahiro.kurosawa@gmail.com
PR: 238412
Approved by: re (kib)

MFC r348667:

While working on a PR, more are discovered.
Remove more #ifdefs missed in r343701.

Approved by: re (gjb@)

MFC r348666:

Clean up #ifdefs from old unsupported releases of FreeBSD.

Approved by: re (gjb@)

MFC r342747 (mmacy): zfsboot: support newer ZFS versions

declare v3 objset size/layout to fix userboot and possibly other loader
issues

- fix for userboot assertion failure in zfs_dev_close in free due to out of
  bounds write
- fix for zfs_alloc / zfs_free mismatch assertion failure when booting GPT
  on BIOS

Approved by: re (gjb)

MFC r348569: [zfsboot] Fix boot env back compat (#190)

* Fix boot env back compat

zfsboot must try zfsloader before loader in order to remain compatible
with boot environments created prior to zfs functionality being rolled
into loader proper.

* Improve comments in zfsboot

Explain the significance of the load path order, and put the comment
about looping through the paths in the appropriate scope.

Approved by: re (gjb)

MFC r348510: bectl(8): Don't accept jid=0 from jail_getid

This will trivially exist, but we don't want it - none of our jailed BEs
will have jid=0.

Approved by: re (gjb)