summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* x86-64: Add memcmp family functions with 256-bit EVEXH.J. Lu2022-01-275-4/+467
| | | | | | | | | Update ifunc-memcmp.h to select the function optimized with 256-bit EVEX instructions using YMM16-YMM31 registers to avoid RTM abort with usable AVX512VL, AVX512BW and MOVBE since VZEROUPPER isn't needed at function exit. (cherry picked from commit 91264fe3577fe887b4860923fa6142b5274c8965)
* x86-64: Add memset family functions with 256-bit EVEXH.J. Lu2022-01-276-14/+90
| | | | | | | | | Update ifunc-memset.h/ifunc-wmemset.h to select the function optimized with 256-bit EVEX instructions using YMM16-YMM31 registers to avoid RTM abort with usable AVX512VL and AVX512BW since VZEROUPPER isn't needed at function exit. (cherry picked from commit 1b968b6b9b3aac702ac2f133e0dd16cfdbb415ee)
* x86-64: Add memmove family functions with 256-bit EVEXH.J. Lu2022-01-275-11/+104
| | | | | | | | Update ifunc-memmove.h to select the function optimized with 256-bit EVEX instructions using YMM16-YMM31 registers to avoid RTM abort with usable AVX512VL since VZEROUPPER isn't needed at function exit. (cherry picked from commit 63ad43566f7a25d140dc723598aeb441ad657eed)
* x86-64: Add strcpy family functions with 256-bit EVEXH.J. Lu2022-01-279-3/+1339
| | | | | | | | Update ifunc-strcpy.h to select the function optimized with 256-bit EVEX instructions using YMM16-YMM31 registers to avoid RTM abort with usable AVX512VL and AVX512BW since VZEROUPPER isn't needed at function exit. (cherry picked from commit 525bc2a32c9710df40371f951217c6ae7a923aee)
* x86-64: Add ifunc-avx2.h functions with 256-bit EVEXH.J. Lu2022-01-2724-17/+2996
| | | | | | | | | | | | Update ifunc-avx2.h, strchr.c, strcmp.c, strncmp.c and wcsnlen.c to select the function optimized with 256-bit EVEX instructions using YMM16-YMM31 registers to avoid RTM abort with usable AVX512VL, AVX512BW and BMI2 since VZEROUPPER isn't needed at function exit. For strcmp/strncmp, prefer AVX2 strcmp/strncmp if Prefer_AVX2_STRCMP is set. (cherry picked from commit 1fd8c163a83d96ace1ff78fa6bac7aee084f6f77)
* x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMPH.J. Lu2022-01-273-2/+21
| | | | | | | | | | | 1. Set Prefer_No_VZEROUPPER if RTM is usable to avoid RTM abort triggered by VZEROUPPER inside a transactionally executing RTM region. 2. Since to compare 2 32-byte strings, 256-bit EVEX strcmp requires 2 loads, 3 VPCMPs and 2 KORDs while AVX2 strcmp requires 1 load, 2 VPCMPEQs, 1 VPMINU and 1 VPMOVMSKB, AVX2 strcmp is faster than EVEX strcmp. Add Prefer_AVX2_STRCMP to prefer AVX2 strcmp family functions. (cherry picked from commit 1da50d4bda07f04135dca39f40e79fc9eabed1f8)
* test-strnlen.c: Check that strnlen won't go beyond the maximum lengthH.J. Lu2022-01-271-0/+30
| | | | | | | Place strings ending at page boundary without the null byte. If an implementation goes beyond EXP_LEN, it will trigger the segfault. (cherry picked from commit cb882b21b63606aabd6e55afe23b42434d95f2ef)
* test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655]H.J. Lu2022-01-271-1/+3
| | | | | | Use wmemset to initialize wchar_t string. (cherry picked from commit 86859b7e58d8670b186c5209ba25f0fbd6612fb7)
* NEWS: Add a bug fix entry for BZ #28755H.J. Lu2022-01-261-0/+1
|
* x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755]Noah Goldstein2022-01-261-0/+10
| | | | | | | | | | | | Fixes [BZ# 28755] for wcsncmp by redirecting length >= 2^56 to __wcscmp_avx2. For x86_64 this covers the entire address range so any length larger could not possibly be used to bound `s1` or `s2`. test-strcmp, test-strncmp, test-wcscmp, and test-wcsncmp all pass. Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com> (cherry picked from commit ddf0992cf57a93200e0c782e2a94d0733a5a0b87) (cherry picked from commit b50d5b746cc0af5ad52164dcb0d3628f08b05a0d)
* aarch64: align stack in clone [BZ #27939]Szabolcs Nagy2022-01-261-0/+2
| | | | | | | | | The AArch64 PCS requires 16 byte aligned stack. Previously if the caller passed an unaligned stack to clone then the child crashed. Fixes bug 27939. (cherry picked from commit 3842ba494963b1d76ad5f68b8d1e5c2279160e31)
* support: Fix xclone build failures on ia64 and hppaFlorian Weimer2022-01-261-4/+3
| | | | (cherry picked from commit 97ed4749becdc20481688ee074e90507ca3501dd)
* Linux: Detect user namespace support in io/tst-getcwd-smallbuffFlorian Weimer2022-01-241-0/+18
| | | | | | | Otherwise the test fails with certain container runtimes. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 5b8e7980c5dabd9aaefeba4f0208baa8cf7653ee)
* realpath: Avoid overwriting preexisting error (CVE-2021-3998)Siddhesh Poyarekar2022-01-241-1/+1
| | | | | | | | | | | Set errno and failure for paths that are too long only if no other error occurred earlier. Related: BZ #28770 Reviewed-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 84d2d0fe20bdf94feed82b21b4d7d136db471f03)
* getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)Siddhesh Poyarekar2022-01-244-1/+261
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No valid path returned by getcwd would fit into 1 byte, so reject the size early and return NULL with errno set to ERANGE. This change is prompted by CVE-2021-3999, which describes a single byte buffer underflow and overflow when all of the following conditions are met: - The buffer size (i.e. the second argument of getcwd) is 1 byte - The current working directory is too long - '/' is also mounted on the current working directory Sequence of events: - In sysdeps/unix/sysv/linux/getcwd.c, the syscall returns ENAMETOOLONG because the linux kernel checks for name length before it checks buffer size - The code falls back to the generic getcwd in sysdeps/posix - In the generic func, the buf[0] is set to '\0' on line 250 - this while loop on line 262 is bypassed: while (!(thisdev == rootdev && thisino == rootino)) since the rootfs (/) is bind mounted onto the directory and the flow goes on to line 449, where it puts a '/' in the byte before the buffer. - Finally on line 458, it moves 2 bytes (the underflowed byte and the '\0') to the buf[0] and buf[1], resulting in a 1 byte buffer overflow. - buf is returned on line 469 and errno is not set. This resolves BZ #28769. Reviewed-by: Andreas Schwab <schwab@linux-m68k.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Qualys Security Advisory <qsa@qualys.com> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e)
* support: Add xcloneAdhemerval Zanella2022-01-243-0/+85
| | | | | | | | It is a wrapper for Linux clone syscall, to simplify the call to the use only the most common arguments and remove architecture specific handling (such as ia64 different name and signature). (cherry picked from commit de8995a2a04163617c1a233b4b81356ef9f9741f)
* tst-realpath-toolong: Fix hurd buildSiddhesh Poyarekar2022-01-241-0/+4
| | | | | | | Define PATH_MAX to a constant if it isn't already defined, like in hurd. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 976db046bc3a3738f69255ae00b0a09b8e77fd9c)
* realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]Siddhesh Poyarekar2022-01-244-3/+66
| | | | | | | | | | | | | | | realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit ee8d5e33adb284601c00c94687bc907e10aec9bb)
* support: Add helpers to create paths longer than PATH_MAXSiddhesh Poyarekar2022-01-242-10/+160
| | | | | | | | | | Add new helpers support_create_and_chdir_toolong_temp_directory and support_chdir_toolong_temp_directory to create and descend into directory trees longer than PATH_MAX. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit fb7bff12e81c677a6622f724edd4d4987dd9d971)
* elf: Fix glibc-hwcaps priorities with cache flags mismatches [BZ #27046]Florian Weimer2022-01-181-64/+60
| | | | | | | | | | | | | | | | | | | | | If lib->flags (in the cache) did not match GLRO (dl_correct_cache_id), searching for further glibc-hwcaps entries did not happen, and it was possible that the best glibc-hwcaps was not found. By accident, this causes a test failure for elf/tst-glibc-hwcaps-prepend-cache on armv7l. This commit changes the cache lookup logic to continue searching if (a) no match has been found, (b) a named glibc-hwcaps match has been found(), or (c) non-glibc-hwcaps match has been found and the entry flags and cache default flags do not match. _DL_CACHE_DEFAULT_ID is used instead of GLRO (dl_correct_cache_id) because the latter is only written once on i386 if loading of libc.so.5 libraries is selected, so GLRO (dl_correct_cache_id) should probably removed in a future change. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 66db95b6e8264c5a6307f6a9e5285fec76907254)
* powerpc: Fix unrecognized instruction errors with recent binutilsPaul A. Clarke2022-01-182-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recent versions of binutils (with commit b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a) stopped preserving "sticky" options across a base `.machine` directive, nullifying the use of passing "-many" through GCC to the assembler. As a result, some instructions which were recognized even under older, more stringent `.machine` directives become unrecognized instructions in that context. In `sysdeps/powerpc/tst-set_ppr.c`, the use of the `mfppr32` extended mnemonic became unrecognized, as the default compilation with GCC for 32bit powerpc adds a `.machine ppc` in the resulting assembly, so the command line option `-Wa,-many` is essentially ignored, and the ISA 2.06 instructions and mnemonics, like `mfppr32`, are unrecognized. The compilation of `sysdeps/powerpc/tst-set_ppr.c` fails with: Error: unrecognized opcode: `mfppr32' Add appropriate `.machine` directives in the assembly to bracket the `mfppr32` instruction. Part of a 2019 fix (commit 9250e6610fdb0f3a6f238d2813e319a41fb7a810) to the above test's Makefile to add `-many` to the compilation when GCC itself stopped passing `-many` to the assember no longer has any effect, so remove that. Reported-by: Joseph Myers <joseph@codesourcery.com> (cherry picked from commit ee874f44fd55988808a4a162ef21bfa2cc8dc6f7)
* CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)Florian Weimer2022-01-184-8/+51
| | | | | | | | The sunrpc function svcunix_create suffers from a stack-based buffer overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit f545ad4928fa1f27a3075265182b38a4f939a5f7)
* <shlib-compat.h>: Support compat_symbol_reference for _ISOMACFlorian Weimer2022-01-181-13/+13
| | | | | | | | This is helpful for testing compat symbols in cases where _ISOMAC is activated implicitly due to -DMODULE_NAME=testsuite and cannot be disabled easily. (cherry picked from commit 36f6e408845c8c539128f3fb9cb132bf1845a2c8)
* sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)Martin Sebor2022-01-182-1/+48
| | | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit ef972a4c50014a16132b5c75571cfb6b30bef136)
* CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)Florian Weimer2022-01-182-3/+12
| | | | | | | | Processing an overlong pathname in the sunrpc clnt_create function results in a stack-based buffer overflow. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 226b46770c82899b555986583294b049c6ec9b40)
* socket: Add the __sockaddr_un_set functionFlorian Weimer2022-01-184-1/+120
| | | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit e368b12f6c16b6888dda99ba641e999b9c9643c8)
* x86: use default cache size if it cannot be determined [BZ #28784]Aurelien Jarno2022-01-172-4/+11
| | | | | | | | | | | | | | | | | | | | | | | In some cases (e.g QEMU, non-Intel/AMD CPU) the cache information can not be retrieved and the corresponding values are set to 0. Commit 2d651eb9265d ("x86: Move x86 processor cache info to cpu_features") changed the behaviour in such case by defining the __x86_shared_cache_size and __x86_data_cache_size variables to 0 instead of using the default values. This cause an issue with the i686 SSE2 optimized bzero/routine which assumes that the cache size is at least 128 bytes, and otherwise tries to zero/set the whole address space minus 128 bytes. Fix that by restoring the original code to only update __x86_shared_cache_size and __x86_data_cache_size variables if the corresponding cache sizes are not zero. Fixes bug 28784 Fixes commit 2d651eb9265d Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit c242fcce06e3102ca663b2f992611d0bda4f2668)
* powerpc: Fix unrecognized instruction errors with recent GCCPaul A. Clarke2022-01-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Recent binutils commit b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a changes the behavior of `.machine` directives to override, rather than augment, the base CPU. This can result in _reduced_ functionality when, for example, compiling for default machine "power8", but explicitly asking for ".machine power5", which loses Altivec instructions. In tst-ucontext-ppc64-vscr.c, while the instructions provoking the new error messages are bracketed by ".machine power5", which is ostensibly Power ISA 2.03 (POWER5), the POWER5 processor did not support the VSX subset, so these instructions are not recognized as "power5". Error: unrecognized opcode: `vspltisb' Error: unrecognized opcode: `vpkuwus' Error: unrecognized opcode: `mfvscr' Error: unrecognized opcode: `stvx' Manually adding the VSX subset via ".machine altivec" is sufficient. Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> (cherry picked from commit 064b475a2e5662b6b3973fabf505eade86e61510)
* powerpc64[le]: Allocate extra stack frame on syscall.SMatheus Castanho2021-12-171-0/+4
| | | | | | | | | | | | | | | The syscall function does not allocate the extra stack frame for scv like other assembly syscalls using DO_CALL_SCV. So after commit d120fb9941 changed the offset that is used to save LR, syscall ended up using an invalid offset, causing regressions on powerpc64. So make sure the extra stack frame is allocated in syscall.S as well to make it consistent with other uses of DO_CALL_SCV and avoid similar issues in the future. Tested on powerpc, powerpc64, and powerpc64le (with and without scv) Reviewed-by: Raphael M Zinsly <rzinsly@linux.ibm.com> (cherry picked from commit ae91d3df24a4a1b1f264d101a71a298bff310d14)
* gconv: Do not emit spurious NUL character in ISO-2022-JP-3 (bug 28524)Nikita Popov2021-12-044-9/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Bugfix 27256 has introduced another issue: In conversion from ISO-2022-JP-3 encoding, it is possible to force iconv to emit extra NUL character on internal state reset. To do this, it is sufficient to feed iconv with escape sequence which switches active character set. The simplified check 'data->__statep->__count != ASCII_set' introduced by the aforementioned bugfix picks that case and behaves as if '\0' character has been queued thus emitting it. To eliminate this issue, these steps are taken: * Restore original condition '(data->__statep->__count & ~7) != ASCII_set'. It is necessary since bits 0-2 may contain number of buffered input characters. * Check that queued character is not NUL. Similar step is taken for main conversion loop. Bundled test case follows following logic: * Try to convert ISO-2022-JP-3 escape sequence switching active character set * Reset internal state by providing NULL as input buffer * Ensure that nothing has been converted. Signed-off-by: Nikita Popov <npv1310@gmail.com> (cherry picked from commit ff012870b2c02a62598c04daa1e54632e020fd7d)
* powerpc64[le]: Fix CFI and LR save address for asm syscalls [BZ #28532]Matheus Castanho2021-11-302-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Syscalls based on the assembly templates are missing CFI for r31, which gets clobbered when scv is used, and info for LR is inaccurate, placed in the wrong LOC and not using the proper offset. LR was also being saved to the callee's frame, while the ABI mandates it to be saved to the caller's frame. These are fixed by this commit. After this change: $ readelf -wF libc.so.6 | grep 0004b9d4.. -A 7 && objdump --disassemble=kill libc.so.6 00004a48 0000000000000020 00004a4c FDE cie=00000000 pc=000000000004b9d4..000000000004ba3c LOC CFA r31 ra 000000000004b9d4 r1+0 u u 000000000004b9e4 r1+48 u u 000000000004b9e8 r1+48 c-16 u 000000000004b9fc r1+48 c-16 c+16 000000000004ba08 r1+48 c-16 000000000004ba18 r1+48 u 000000000004ba1c r1+0 u libc.so.6: file format elf64-powerpcle Disassembly of section .text: 000000000004b9d4 <kill>: 4b9d4: 1f 00 4c 3c addis r2,r12,31 4b9d8: 2c c3 42 38 addi r2,r2,-15572 4b9dc: 25 00 00 38 li r0,37 4b9e0: d1 ff 21 f8 stdu r1,-48(r1) 4b9e4: 20 00 e1 fb std r31,32(r1) 4b9e8: 98 8f ed eb ld r31,-28776(r13) 4b9ec: 10 00 ff 77 andis. r31,r31,16 4b9f0: 1c 00 82 41 beq 4ba0c <kill+0x38> 4b9f4: a6 02 28 7d mflr r9 4b9f8: 40 00 21 f9 std r9,64(r1) 4b9fc: 01 00 00 44 scv 0 4ba00: 40 00 21 e9 ld r9,64(r1) 4ba04: a6 03 28 7d mtlr r9 4ba08: 08 00 00 48 b 4ba10 <kill+0x3c> 4ba0c: 02 00 00 44 sc 4ba10: 00 00 bf 2e cmpdi cr5,r31,0 4ba14: 20 00 e1 eb ld r31,32(r1) 4ba18: 30 00 21 38 addi r1,r1,48 4ba1c: 18 00 96 41 beq cr5,4ba34 <kill+0x60> 4ba20: 01 f0 20 39 li r9,-4095 4ba24: 40 48 23 7c cmpld r3,r9 4ba28: 20 00 e0 4d bltlr+ 4ba2c: d0 00 63 7c neg r3,r3 4ba30: 08 00 00 48 b 4ba38 <kill+0x64> 4ba34: 20 00 e3 4c bnslr+ 4ba38: c8 32 fe 4b b 2ed00 <__syscall_error> ... 4ba44: 40 20 0c 00 .long 0xc2040 4ba48: 68 00 00 00 .long 0x68 4ba4c: 06 00 5f 5f rlwnm r31,r26,r0,0,3 4ba50: 6b 69 6c 6c xoris r12,r3,26987 (cherry picked from commit d120fb9941be1fb1934f0b50c6ad64e4c5e404fb)
* nptl: Do not set signal mask on second setjmp return [BZ #28607]Florian Weimer2021-11-244-2/+49
| | | | | | | | | | | | | __libc_signal_restore_set was in the wrong place: It also ran when setjmp returned the second time (after pthread_exit or pthread_cancel). This is observable with blocked pending signals during thread exit. Fixes commit b3cae39dcbfa2432b3f3aa28854d8ac57f0de1b8 ("nptl: Start new threads with all signals blocked [BZ #25098]"). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit e186fc5a31e46f2cbf5ea1a75223b4412907f3d8)
* support: Add xpthread_killAdhemerval Zanella2021-11-243-0/+29
| | | | | | Checked on x86_64-linux-gnu. (cherry picked from commit 0280b390fbd4c55a708985829d58a639475bbffb)
* s390: Use long branches across object boundaries (jgh instead of jh)Florian Weimer2021-11-102-2/+2
| | | | | | | | | | | Depending on the layout chosen by the linker, the 16-bit displacement of the jh instruction is insufficient to reach the target label. Analysis of the linker failure was carried out by Nick Clifton. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Stefan Liebler <stli@linux.ibm.com> (cherry picked from commit 98966749f2b418825ff2ea496a0ee89fe63d2cc8)
* elf: Replace nsid with args.nsid [BZ #27609]H.J. Lu2021-10-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ec935dea6332cb22f9881cd1162bad156173f4b0 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Apr 24 22:31:15 2020 +0200 elf: Implement __libc_early_init has @@ -856,6 +876,11 @@ no more namespaces available for dlmopen()")); /* See if an error occurred during loading. */ if (__glibc_unlikely (exception.errstring != NULL)) { + /* Avoid keeping around a dangling reference to the libc.so link + map in case it has been cached in libc_map. */ + if (!args.libc_already_loaded) + GL(dl_ns)[nsid].libc_map = NULL; + do_dlopen calls _dl_open with nsid == __LM_ID_CALLER (-2), which calls dl_open_worker with args.nsid = nsid. dl_open_worker updates args.nsid if it is __LM_ID_CALLER. After dl_open_worker returns, it is wrong to use nsid. Replace nsid with args.nsid after dl_open_worker returns. This fixes BZ #27609. (cherry picked from commit 1e1ecea62e899acb58c3fdf3b320a0833ddd0dff)
* S390: Add PCI_MIO and SIE HWCAPsStefan Liebler2021-10-073-3/+12
| | | | | | | | | | | | | | | Both new HWCAPs were introduced in these kernel commits: - 7e8403ecaf884f307b627f3c371475913dd29292 "s390: add HWCAP_S390_PCI_MIO to ELF hwcaps" - 7e82523f2583e9813e4109df3656707162541297 "s390/hwcaps: make sie capability regular hwcap" Also note that the kernel commit 511ad531afd4090625def4d9aba1f5227bd44b8e "s390/hwcaps: shorten HWCAP defines" has shortened the prefix of the macros from "HWCAP_S390_" to "HWCAP_". For compatibility reasons, we do not change the prefix in public glibc header file. (cherry picked from commit f2e06656d04a9fcb0603802a4f8ce7aa3a1f055e)
* posix: Fix attribute access mode on getcwd [BZ #27476]Aurelien Jarno2021-09-192-5/+3
| | | | | | | | | | | There is a GNU extension that allows to call getcwd(NULL, >0). It is described in the documentation, but also directly in the unistd.h header, just above the declaration. Therefore the attribute access mode added in commit 06febd8c6705 is not correct. Drop it. (cherry picked from commit 63a788f48a713f2081f200dd054df3e728b0e7c2)
* Fix failing nss/tst-nss-files-hosts-long with local resolverAurelien Jarno2021-09-141-0/+1
| | | | | | | | | | | | | | | | | | | | When a local resolver like unbound is listening on the IPv4 loopback address 127.0.0.1, the nss/tst-nss-files-hosts-long test fails. This is due to: - the default resolver in the absence of resolv.conf being 127.0.0.1 - the default DNS NSS database configuration in the absence of nsswitch.conf being 'hosts: dns [!UNAVAIL=return] file' This causes the requests for 'test4' and 'test6' to first be sent to the local resolver, which responds with NXDOMAIN in the likely case those records do no exist. In turn that causes the access to /etc/hosts to be skipped, which is the purpose of that test. Fix that by providing a simple nsswitch.conf file forcing access to /etc/hosts for that test. I have tested that the only changed result in the testsuite is that test. (cherry picked from commit 2738480a4b0866723fb8c633f36bdd34a8767581)
* MIPS: Setup errno for {f,l,}xstatJiaxun Yang2021-09-073-3/+9
| | | | | | | | | | | | | {f,l,}xstat stub for MIPS is using INTERNAL_SYSCALL to do xstat syscall for glibc ver, However it leaves errno untouched and thus giving bad errno output. Setup errno properly when syscall returns non-zero. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 66016ec8aeefd40e016d7040d966484c764b0e9c)
* RISC-V: Update rv64 ULPsAurelien Jarno2021-09-011-11/+13
| | | | | Generated on both a Microsemi Polarfire Icicle Kit and a BeagleV Starlight, resulting in identical ULPs.
* linux: Remove shmmax check from tst-sysvshm-linuxAdhemerval Zanella2021-08-221-12/+14
| | | | | | | | | | | | | | | | | | | | | | The shmmax expected value is tricky to check because kernel clamps it to INT_MAX in two cases: 1. Compat symbols with IPC_64, i.e, 32-bit binaries running on 64-bit kernels. 2. Default symbol without IPC_64 (defined as IPC_OLD within Linux) and glibc always use IPC_64 for 32-bit ABIs (to support 64-bit time_t). It means that 32-bit binaries running on 32-bit kernels will not see shmmax being clamped. And finding out whether the compat symbol is used would require checking the underlying kernel against the current ABI. The shmall and shmmni already provided enough coverage. Checked on x86_64-linux-gnu and i686-linux-gnu. It should fix the tst-sysvshm-linux failures on 32-bit kernels. (cherry picked from commit 913201078502ad3f10043db02a8efce5d75387c2)
* librt: add test (bug 28213)Nikita Popov2021-08-172-0/+102
| | | | | | | | | | | | | | | | | This test implements following logic: 1) Create POSIX message queue. Register a notification with mq_notify (using NULL attributes). Then immediately unregister the notification with mq_notify. Helper thread in a vulnerable version of glibc should cause NULL pointer dereference after these steps. 2) Once again, register the same notification. Try to send a dummy message. Test is considered successfulif the dummy message is successfully received by the callback function. Signed-off-by: Nikita Popov <npv1310@gmail.com> Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 4cc79c217744743077bf7a0ec5e0a4318f1e6641)
* librt: fix NULL pointer dereference (bug 28213)Nikita Popov2021-08-171-1/+1
| | | | | | | | | | | | | | | | | | Helper thread frees copied attribute on NOTIFY_REMOVED message received from the OS kernel. Unfortunately, it fails to check whether copied attribute actually exists (data.attr != NULL). This worked earlier because free() checks passed pointer before actually attempting to release corresponding memory. But __pthread_attr_destroy assumes pointer is not NULL. So passing NULL pointer to __pthread_attr_destroy will result in segmentation fault. This scenario is possible if notification->sigev_notify_attributes == NULL (which means default thread attributes should be used). Signed-off-by: Nikita Popov <npv1310@gmail.com> Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
* x86_64: Remove unneeded static PIE check for undefined weak diagnosticFangrui Song2021-07-082-58/+0
| | | | | | | | | | | | | | | | https://sourceware.org/bugzilla/show_bug.cgi?id=21782 dropped an ld diagnostic for R_X86_64_PC32 referencing an undefined weak symbol in -pie links. Arguably keeping the diagnostic like other ports is more correct, since statically resolving movl foo(%rip), %eax to the link-time zero address produces a corrupted output. It turns out that --enable-static-pie builds do not depend on the ld behavior. GCC generates GOT indirection for weak declarations for -fPIE/-fPIC, so what ld does with the PC-relative relocation doesn't really matter. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 115d242456de158e698ffb0f9a5fee3118e9e825)
* wordexp: handle overflow in positional parameter number (bug 28011)Andreas Schwab2021-07-062-1/+2
| | | | | | Use strtoul instead of atoi so that overflow can be detected. (cherry picked from commit 5adda61f62b77384718b4c0d8336ade8f2b4b35c)
* elf: Use _dl_catch_error from base namespace in dl-libc.c [BZ #27646]Florian Weimer2021-06-185-3/+73
| | | | | | | | | | | | | | | dlerrror_run in elf/dl-libc.c needs to call GLRO (dl_catch_error) from the base namespace, just like the exported dlerror implementation. Fixes commit b2964eb1d9a6b8ab1250e8a881cf406182da5875 ("dlfcn: Failures after dlmopen should not terminate process [BZ #24772]"). Backport notes: GLRO (dl_catch_error) is replaced with _dl_catch_error_ptr to preserve _rtld_global_ro layout. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit c2059edce20c124d1a99f1a94cc52e83b77a917a)
* Fix use of __pthread_attr_copy in mq_notify (bug 27896)Florian Weimer2021-06-101-2/+9
| | | | | | | | | | | | | | | __pthread_attr_copy can fail and does not initialize the attribute structure in that case. If __pthread_attr_copy is never called and there is no allocated attribute, pthread_attr_destroy should not be called, otherwise there is a null pointer dereference in rt/tst-mqueue6. Fixes commit 42d359350510506b87101cf77202fefcbfc790cb ("Use __pthread_attr_copy in mq_notify (bug 27896)"). Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 217b6dc298156bdb0d6aea9ea93e7e394a5ff091)
* Use __pthread_attr_copy in mq_notify (bug 27896)Andreas Schwab2021-06-102-5/+16
| | | | | | | Make a deep copy of the pthread attribute object to remove a potential use-after-free issue. (cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb)
* dlfcn: Failures after dlmopen should not terminate process [BZ #15271]Florian Weimer2021-06-099-5/+124
| | | | | | | | | | | | | | | | | | | Commit 9e78f6f6e7134a5f299cc8de77370218f8019237 ("Implement _dl_catch_error, _dl_signal_error in libc.so [BZ #16628]") has the side effect that distinct namespaces, as created by dlmopen, now have separate implementations of the rtld exception mechanism. This means that the call to _dl_catch_error from libdl in a secondary namespace does not actually install an exception handler because the thread-local variable catch_hook in the libc.so copy in the secondary namespace is distinct from that of the base namepace. As a result, a dlsym/dlopen/... failure in a secondary namespace terminates the process with a dynamic linker error because it looks to the exception handler mechanism as if no handler has been installed. Backport notes: GLRO (dl_catch_error) is replaced with _dl_catch_error_ptr to preserve _rtld_global_ro layout. (cherry picked from commit b2964eb1d9a6b8ab1250e8a881cf406182da5875)
* powerpc: Fix handling of scv return error codes [BZ #27892]Nicholas Piggin2021-05-242-2/+4
| | | | | | | | | | | | When using scv for templated ASM syscalls, current code interprets any negative return value as error, but the only valid error codes are in the range -4095..-1 according to the ABI. This commit also fixes 'signal.gen.test' strace test, where the issue was first identified. Reviewed-by: Matheus Castanho <msc@linux.ibm.com> (cherry picked from commit 7de36744ee1325f35d3fe0ca079dd33c40b12267)
View Lorry Controller Status