Pull up following revision(s) (requested by lukem in ticket #1180):
	usr.bin/ftp/version.h: revision 1.85
Version 20141026
Ignore special characters unless they're from the command line.
Fixes CVE-2014-8517
Ticket 1180.
Pull up following revision(s) (requested by riastradh in ticket #1117):
	sys/dev/rasops/rasops.c: revision 1.72
	sys/dev/vme/if_ie_vme.c: revision 1.31
	sys/dev/qbus/if_qe.c: revision 1.73
	sys/altq/altq_jobs.c: revision 1.7
	sys/net/if_gre.c: revision 1.160
	sys/dev/ic/oosiop.c: revision 1.14
- Fix error branches in altq_jobs.c to avoid leaks, noted by maxv@.
- Fix leaks in oosiop_alloc_cb error branches, noted by maxv@.
  While here, avoid a sketchy pointer cast that probably falls afoul of
  strict aliasing rules. Compile-tested only, with hppa.
- Don't leak f on failurein rasops.c.  Noted by maxv@.
  Compile-tested only, with zaurus.
- Avoid leak in error branch in if_qe.c, noted by maxv@, compile-tested for
  vax.
- Sizeof struct ievme, not sizeof size_t in if_ie_vme.c.
  Noted by maxv@, compile-tested for sparc.
- Don't leak in gre_clone_create error branch.
  Noted by maxv@, compile-tested for amd64.
Pull up following revision(s) (requested by riastradh in ticket #1118):
	sys/kern/kern_rndq.c: revision 1.27
	sys/kern/kern_rndpool.c: revision 1.7
buf is not guaranteed to be aligned; don't *(uint32_t *) it in kern_rndq.c.
done is not guaranteed to be aligned; don't *(uint32_t *) it in kern_rndpool.c.
Pull up following revision(s) (requested by riastradh in ticket #1121):
	lib/libc/stdlib/jemalloc.c: revision 1.33
Hold arenas_mtx across (still unused) _malloc_pre/postfork (PR 47428).
Pull up following revision(s) (requested by tsutsui in ticket #1139):
	sys/arch/sun3/dev/fd.c: revision 1.78
	sys/arch/sparc/dev/fd.c: revision 1.155
	sys/arch/sparc64/dev/fdc.c: revision 1.42
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
I'm not sure why this 18 year old bug didn't cause problem before
(at least my old 5.99.23 kernel worked), but probably it's triggered
by new gcc 4.8 which might do more aggressive memory allocation.
The problem is found by Nobuyoshi Sato on trying eject(1) against fd(4).
Should be pulled up to netbsd-7.
Sync with sparc/dev/fd.c:1.155.
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
I'm not sure why this 18 year old bug didn't cause problem before
(at least my old 5.99.23 kernel worked), but probably it's triggered
by new gcc 4.8 which might do more aggressive memory allocation.
The problem is found by Nobuyoshi Sato on trying eject(1) against fd(4).
Should be pulled up to netbsd-7.
Sync with sparc/dev/fd.c rev 1.155.
Fix panic() on opening fd(4), caused by a wrong pointer passed to memset().
Note sun3 still uses gcc 4.5.4 but also panicked by this old bug,
so probably this problem was triggered by not gcc 4.8 but struct disk
changes (struct disk_geom was added in <sys/disk.h> rev 1.58),
which increased sizeof(struct fd_softc) from 248 bytes to 296 bytes.
(i.e. now struct fd_softc could be allocated in a different pool block,
 probably near the wrong pointer of the struct disklabel)
Anyway, this fix should be pullued up to netbsd-7.
(probably I'm the only user of floppy on sun3 though)
Ticket 1116-1118, 1121 and 1139.
Add missing "xsrc/" prefix (Ticket 1116).
Pull up following revision(s) (requested by manu in ticket #1140):
	lib/libperfuse/ops.c				1.63-1.69
	lib/libperfuse/perfuse.c			1.32-1.33
	lib/libperfuse/perfuse_priv.h			1.32-1.34
	lib/libperfuse/subr.c				1.20
	lib/libpuffs/creds.c				1.16
	lib/libpuffs/dispatcher.c			1.47
	lib/libpuffs/puffs.h				1.125
	lib/libpuffs/puffs_ops.3			1.37-1.38
	lib/libpuffs/requests.c				1.24
	sys/fs/puffs/puffs_msgif.h			1.81
	sys/fs/puffs/puffs_sys.h			1.85
	sys/fs/puffs/puffs_vnops.c			1.183
	usr.sbin/perfused/msg.c				1.22
Bring libpuffs, libperfuse and perfused on par with -current:
- implement  FUSE direct I/O
- remove useless code and warnings
- fix missing GETATTR bugs
- fix exended attribute get and list operations
Pull up following revision(s) (requested by manu in ticket #1143):
	usr.bin/flock/flock.c: revision 1.10
	usr.bin/flock/flock.c: revision 1.11
	usr.bin/flock/flock.1: revision 1.10
	usr.bin/flock/flock.c: revision 1.8
PR/48351: Dennis Ferguson: Fix incorrect parsing of flock flags.
XXX: still flock -s 0 fails with EINVAL, why?
make this behave like linux.
remove XXX, fix error message
mention that -x is the default.
Pull up following revision(s) (requested by manu in ticket #1144):
	lib/libperfuse/ops.c: revision 1.70
We used to remove the trailing zeros in FUSE readlink replies, but
it seems it does not always happen. Just remove them if present.
Pull up following revision(s) (requested by manu in ticket #1147):
	lib/libperfuse/perfuse.c: revision 1.34
	lib/libperfuse/ops.c: revision 1.71
Improve POSIX compliance of FUSE filesystems through PERUSE
- access denied is EPERM and not EACCES
- access to file owned by someone else in a sticy-bit directory should
  be allowed for the sticy-bit directory owner
- setting sticky-bit on a non directory should produce EFTYPE
- implement PATHCONF method as much as we can.
Pull up following revision(s) (requested by manu in ticket #1148):
	lib/libperfuse/ops.c: revision 1.73
rmdir dir/.. must return an error. Use ENOTEMPTY like FFS does.
Pull up following revision(s) (requested by manu in ticket #1149):
	sys/fs/puffs/puffs_node.c: revision 1.33
	sys/fs/puffs/puffs_vnops.c: revision 1.185
When changing a directory content, update the ctime/mtime in kernel
cache,
otherwise the updated ctime/mtime appears after the cached entry expire.
Pull up following revision(s) (requested by manu in ticket #1150):
	lib/libc/sys/truncate.2: revision 1.27
	sys/kern/vfs_syscalls.c: revision 1.484
Follow OpenGroup online documents for truncate[1] and ftruncate[2].
Fail with EINVAL for length argument negative values.
[1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/truncate.html
[2] http://pubs.opengroup.org/onlinepubs/9699919799/functions/ftruncate.html
Pull up following revision(s) (requested by manu in ticket #1152):
	sys/fs/puffs/puffs_vnops.c: revision 1.186
PUFFS fixes for size update ater write plus read/write sanity checks
- Always update kernel metadata cache for size when writing
  This fixes situation where size update after appending to a file lagged
- Make read/write nilpotent when called with null size, as FFS does
- Return EFBIG instead of EINVAL for negative offsets, as FFS does
Ticket 1140, 1143-1144, 1147-1150 and 1152.
Pull up following revision(s) (requested by ozaki-r in ticket #1156):
	sbin/ifconfig/vlan.c: revision 1.14
	sbin/ifconfig/ifconfig.8: revision 1.108
	sys/net/if_vlan.c: revision 1.71
	sys/net/if_vlan.c: revision 1.73
	sys/net/if_vlan.c: revision 1.74
- PR#49114: Write about -vlanif in ifconfig.8.
  Add -vlanif to the help message of ifconfig.
- PR#49196: Leave promiscuous mode when detaching a parent (ifconfig -vlanif)
  We have to call ifpromisc(ifp, 0) for both a VLAN interface
  and its parent when they are in promiscuous mode.
- PR#49197: Delete link local addresses of a vlan interface when detaching its
  parent.
- PR#49112: Restore vlan_ioctl overwritten by ether_ifdetach in vlan_unconfig
Pull up following revision(s) (requested by joerg in ticket #1157):
	external/gpl3/gcc.old/dist/gcc/config/i386/pmm_malloc.h: revision 1.2
Apply r1.2 from our GCC 4.8 version of the same file:
Kill the "throw()" on a forward declaration for posix_memalign (it does
not match our base declaration and may cause warnings).
Pull up following revision(s) (requested by gdt in ticket #1163):
	etc/mtree/Makefile: revision 1.24
silence is golden