summaryrefslogtreecommitdiff
path: root/NEWS
Commit message (Collapse)AuthorAgeFilesLines
* x86: Check IFUNC definition in unrelocated executable [BZ #20019]H.J. Lu2021-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Calling an IFUNC function defined in unrelocated executable also leads to segfault. Issue a fatal error message when calling IFUNC function defined in the unrelocated executable from a shared library. On x86, ifuncmain6pie failed with: [hjl@gnu-cfl-2 build-i686-linux]$ ./elf/ifuncmain6pie --direct ./elf/ifuncmain6pie: IFUNC symbol 'foo' referenced in '/export/build/gnu/tools-build/glibc-32bit/build-i686-linux/elf/ifuncmod6.so' is defined in the executable and creates an unsatisfiable circular dependency. [hjl@gnu-cfl-2 build-i686-linux]$ readelf -rW elf/ifuncmod6.so | grep foo 00003ff4 00000706 R_386_GLOB_DAT 0000400c foo_ptr 00003ff8 00000406 R_386_GLOB_DAT 00000000 foo 0000400c 00000401 R_386_32 00000000 foo [hjl@gnu-cfl-2 build-i686-linux]$ Remove non-JUMP_SLOT relocations against foo in ifuncmod6.so, which trigger the circular IFUNC dependency, and build ifuncmain6pie with -Wl,-z,lazy. (cherry picked from commits 6ea5b57afa5cdc9ce367d2b69a2cebfb273e4617 and 7137d682ebfcb6db5dfc5f39724718699922f06c)
* x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]H.J. Lu2021-01-131-0/+1
| | | | | | | Update dl_cet_check() to set header.feature_1 in TCB when both IBT and SHSTK are always on. (cherry picked from commit 2ef23b520597f4ea1790a669b83e608f24f4cf12)
* x86-64: Avoid rep movsb with short distance [BZ #27130]H.J. Lu2021-01-121-0/+1
| | | | | | | | | | | | | | | | | | | When copying with "rep movsb", if the distance between source and destination is N*4GB + [1..63] with N >= 0, performance may be very slow. This patch updates memmove-vec-unaligned-erms.S for AVX and AVX512 versions with the distance in RCX: cmpl $63, %ecx // Don't use "rep movsb" if ECX <= 63 jbe L(Don't use rep movsb") Use "rep movsb" Benchtests data with bench-memcpy, bench-memcpy-large, bench-memcpy-random and bench-memcpy-walk on Skylake, Ice Lake and Tiger Lake show that its performance impact is within noise range as "rep movsb" is only used for data size >= 4KB. (cherry picked from commit 3ec5d83d2a237d39e7fd6ef7a0bc8ac4c171a4a5)
* NEWS: Mention BZ 25933 fixH.J. Lu2020-07-041-0/+1
|
* Fix use-after-free in glob when expanding ~user (bug 25414)Andreas Schwab2020-03-201-0/+4
| | | | | | | The value of `end_name' points into the value of `dirname', thus don't deallocate the latter before the last use of the former. (cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
* Fix array overflow in backtrace on PowerPC (bug 25423)Andreas Schwab2020-03-201-0/+1
| | | | | | | | When unwinding through a signal frame the backtrace function on PowerPC didn't check array bounds when storing the frame address. Fixes commit d400dcac5e ("PowerPC: fix backtrace to handle signal trampolines"). (cherry picked from commit d93769405996dfc11d216ddbe415946617b5a494)
* <string.h>: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]Kamlesh Kumar2019-12-051-0/+1
| | | | | | | | | | | | | Without the asm redirects, strchr et al. are not const-correct. libc++ has a wrapper header that works with and without __CORRECT_ISO_CPP_STRING_H_PROTO (using a Clang extension). But when Clang is used with libstdc++ or just C headers, the overloaded functions with the correct types are not declared. This change does not impact current GCC (with libstdc++ or libc++). (cherry picked from commit 953ceff17a4a15b10cfdd5edc3c8cae4884c8ec3)
* x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]Florian Weimer2019-12-031-0/+1
| | | | | | | | | This links in CET support if GCC defaults to CET. Otherwise, __CET__ is defined, yet CET functionality is not compiled and linked into the dynamic loader, resulting in a linker failure due to undefined references to _dl_cet_check and _dl_open_check. (cherry picked from commit 9fb8139079ef0bb1aa33a4ae418cbb113b9b9da7)
* libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]Florian Weimer2019-11-281-0/+1
| | | | | | | | | | | | | Commit c402355dfa7807b8e0adb27c009135a7e2b9f1b0 ("libio: Disable vtable validation in case of interposition [BZ #23313]") only covered the interposable glibc 2.1 handles, in libio/stdfiles.c. The parallel code in libio/oldstdfiles.c needs similar detection logic. Fixes (again) commit db3476aff19b75c4fdefbe65fcd5f0a90588ba51 ("libio: Implement vtable verification [BZ #20191]"). Change-Id: Ief6f9f17e91d1f7263421c56a7dc018f4f595c21 (cherry picked from commit cb61630ed712d033f54295f776967532d3f4b46a)
* rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC ↵Marcin Kościelnicki2019-11-221-0/+8
| | | | | | | | | | (CVE-2019-19126) [BZ #25204] The problem was introduced in glibc 2.23, in commit b9eb92ab05204df772eb4929eccd018637c9f3e9 ("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT"). (cherry picked from commit d5dfad4326fc683c813df1e37bbf5cf920591c8e)
* io: Remove copy_file_range emulation [BZ #24744]Florian Weimer2019-07-091-0/+9
| | | | | | | | | | | The kernel is evolving this interface (e.g., removal of the restriction on cross-device copies), and keeping up with that is difficult. Applications which need the function should run kernels which support the system call instead of relying on the imperfect glibc emulation. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 5a659ccc0ec217ab02a4c273a1f6d346a359560a)
* libio: do not attempt to free wide buffers of legacy streams [BZ #24228]Dmitry V. Levin2019-06-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit a601b74d31ca086de38441d316a3dee24c866305 aka glibc-2.23~693 ("In preparation for fixing BZ#16734, fix failure in misc/tst-error1-mem when _G_HAVE_MMAP is turned off.") introduced a regression: _IO_unbuffer_all now invokes _IO_wsetb to free wide buffers of all files, including legacy standard files which are small statically allocated objects that do not have wide buffers and the _mode member, causing memory corruption. Another memory corruption in _IO_unbuffer_all happens when -1 is assigned to the _mode member of legacy standard files that do not have it. [BZ #24228] * libio/genops.c (_IO_unbuffer_all) [SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_1)]: Do not attempt to free wide buffers and access _IO_FILE_complete members of legacy libio streams. * libio/tst-bz24228.c: New file. * libio/tst-bz24228.map: Likewise. * libio/Makefile [build-shared] (tests): Add tst-bz24228. [build-shared] (generated): Add tst-bz24228.mtrace and tst-bz24228.check. [run-built-tests && build-shared] (tests-special): Add $(objpfx)tst-bz24228-mem.out. (LDFLAGS-tst-bz24228, tst-bz24228-ENV): New variables. ($(objpfx)tst-bz24228-mem.out): New rule. (cherry picked from commit 21cc130b78a4db9113fb6695e2b951e697662440)
* dlfcn: Guard __dlerror_main_freeres with __libc_once_get (once) [BZ#24476]Mark Wielaard2019-05-161-0/+1
| | | | | | | | | | | | | | | | | | | dlerror.c (__dlerror_main_freeres) will try to free resources which only have been initialized when init () has been called. That function is called when resources are needed using __libc_once (once, init) where once is a __libc_once_define (static, once) in the dlerror.c file. Trying to free those resources if init () hasn't been called will produce errors under valgrind memcheck. So guard the freeing of those resources using __libc_once_get (once) and make sure we have a valid key. Also add a similar guard to __dlerror (). * dlfcn/dlerror.c (__dlerror_main_freeres): Guard using __libc_once_get (once) and static_bug == NULL. (__dlerror): Check we have a valid key, set result to static_buf otherwise. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 11b451c8868d8a2b0edc5dfd44fc58d9ee538be0)
* Fix crash in _IO_wfile_sync (bug 20568)Andreas Schwab2019-05-151-0/+1
| | | | | | | | When computing the length of the converted part of the stdio buffer, use the number of consumed wide characters, not the (negative) distance to the end of the wide buffer. (cherry picked from commit 32ff397533715988c19cbf3675dcbd727ec13e18)
* elf: Fix pldd (BZ#18035)Adhemerval Zanella2019-04-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since 9182aa67994 (Fix vDSO l_name for GDB's, BZ#387) the initial link_map for executable itself and loader will have both l_name and l_libname->name holding the same value due: elf/dl-object.c 95 new->l_name = *realname ? realname : (char *) newname->name + libname_len - 1; Since newname->name points to new->l_libname->name. This leads to pldd to an infinite call at: elf/pldd-xx.c 203 again: 204 while (1) 205 { 206 ssize_t n = pread64 (memfd, tmpbuf.data, tmpbuf.length, name_offset); 228 /* Try the l_libname element. */ 229 struct E(libname_list) ln; 230 if (pread64 (memfd, &ln, sizeof (ln), m.l_libname) == sizeof (ln)) 231 { 232 name_offset = ln.name; 233 goto again; 234 } Since the value at ln.name (l_libname->name) will be the same as previously read. The straightforward fix is just avoid the check and read the new list entry. I checked also against binaries issues with old loaders with fix for BZ#387, and pldd could dump the shared objects. Checked on x86_64-linux-gnu, i686-linux-gnu, aarch64-linux-gnu, and powerpc64le-linux-gnu. [BZ #18035] * elf/Makefile (tests-container): Add tst-pldd. * elf/pldd-xx.c: Use _Static_assert in of pldd_assert. (E(find_maps)): Avoid use alloca, use default read file operations instead of explicit LFS names, and fix infinite loop. * elf/pldd.c: Explicit set _FILE_OFFSET_BITS, cleanup headers. (get_process_info): Use _Static_assert instead of assert, use default directory operations instead of explicit LFS names, and free some leadek pointers. * elf/tst-pldd.c: New file. (cherry picked from commit 1a4c27355e146b6d8cc6487b998462c7fdd1048f) (Backported without the test case due to lack of test-in-container support.)
* Revert "memusagestat: use local glibc when linking [BZ #18465]"Florian Weimer2019-04-251-1/+0
| | | | | | | | This reverts commit 630d7201ceb12f8dcdbe20abce67e1333c5e15ee. The position of the -Wl,-rpath-link= options on the linker command line is not correct, so the new way of linking memusagestat does not always work.
* memusagestat: use local glibc when linking [BZ #18465]Mike Frysinger2019-04-241-0/+1
| | | | | | | | | | | The memusagestat is the only binary that has its own link line which causes it to be linked against the existing installed C library. It has been this way since it was originally committed in 1999, but I don't see any reason as to why. Since we want all the programs we build locally to be against the new copy of glibc, change the build to be like all other programs. (cherry picked from commit f9b645b4b0a10c43753296ce3fa40053fa44606a)
* ja_JP locale: Add entry for the new Japanese era [BZ #22964]TAMUKI Shoichi2019-04-031-0/+4
| | | | | | | | | | | | The Japanese era name will be changed on May 1, 2019. The Japanese government made a preliminary announcement on April 1, 2019. The glibc ja_JP locale must be updated to include the new era name for strftime's alternative year format support. This is a minimal cherry pick of just the required locale changes. (cherry picked from commit 466afec30896585b60c2106df7a722a86247c9f3)
* Record CVE-2019-9169 in NEWS and ChangeLog [BZ #24114]Aurelien Jarno2019-03-161-0/+4
| | | | (cherry picked from commit b626c5aa5d0673a9caa48fb79fba8bda237e6fa8)
* RISC-V: don't assume PI mutexes and robust futexes before 4.20 (bug 23864)Andreas Schwab2019-03-141-0/+1
| | | | | | Support for futex_cmpxchg as only been added to 4.20-rc1. (cherry picked from commit 295132ff052b32960207d82a950c0efbf0766857)
* powerpc: Only enable TLE with PPC_FEATURE2_HTM_NOSCAdhemerval Zanella2019-02-271-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux from 3.9 through 4.2 does not abort HTM transaction on syscalls, instead it suspend and resume it when leaving the kernel. The side-effects of the syscall will always remain visible, even if the transaction is aborted. This is an issue when transaction is used along with futex syscall, on pthread_cond_wait for instance, where the futex call might succeed but the transaction is rolled back leading the pthread_cond object in an inconsistent state. Glibc used to prevent it by always aborting a transaction before issuing a syscall. Linux 4.2 also decided to abort active transaction in syscalls which makes the glibc workaround superfluous. Worse, glibc transaction abortion leads to a performance issue on recent kernels where the HTM state is saved/restore lazily (v4.9). By aborting a transaction on every syscalls, regardless whether a transaction has being initiated before, GLIBS makes the kernel always save/restore HTM state (it can not even lazily disable it after a certain number of syscall iterations). Because of this shortcoming, Transactional Lock Elision is just enabled when it has been explicitly set (either by tunables of by a configure switch) and if kernel aborts HTM transactions on syscalls (PPC_FEATURE2_HTM_NOSC). It is reported that using simple benchmark [1], the context-switch is about 5% faster by not issuing a tabort in every syscall in newer kernels. Checked on powerpc64le-linux-gnu with 4.4.0 kernel (Ubuntu 16.04). * NEWS: Add note about new TLE support on powerpc64le. * sysdeps/powerpc/nptl/tcb-offsets.sym (TM_CAPABLE): Remove. * sysdeps/powerpc/nptl/tls.h (tcbhead_t): Rename tm_capable to __ununsed1. (TLS_INIT_TP, TLS_DEFINE_INIT_TP): Remove tm_capable setup. (THREAD_GET_TM_CAPABLE, THREAD_SET_TM_CAPABLE): Remove macros. * sysdeps/powerpc/powerpc32/sysdep.h, sysdeps/powerpc/powerpc64/sysdep.h (ABORT_TRANSACTION_IMPL, ABORT_TRANSACTION): Remove macros. * sysdeps/powerpc/sysdep.h (ABORT_TRANSACTION): Likewise. * sysdeps/unix/sysv/linux/powerpc/elision-conf.c (elision_init): Set __pthread_force_elision iff PPC_FEATURE2_HTM_NOSC is set. * sysdeps/unix/sysv/linux/powerpc/powerpc32/sysdep.h, sysdeps/unix/sysv/linux/powerpc/powerpc64/sysdep.h sysdeps/unix/sysv/linux/powerpc/syscall.S (ABORT_TRANSACTION): Remove usage. * sysdeps/unix/sysv/linux/powerpc/not-errno.h: Remove file. Reported-by: Breno Leitão <leitao@debian.org> (cherry picked from commit f0458cf4f9ff3d870c43b624e6dccaaf657d5e83)
* RISC-V: Fix elfutils testsuite unwind failures.Jim Wilson2019-02-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The clone.S patch fixes 2 elfutils testsuite unwind failures, where the backtrace gets stuck repeating __thread_start until we hit the backtrace limit. This was confirmed by building and installing a patched glibc and then building elfutils and running its testsuite. Unfortunately, the testcase isn't working as expected and I don't know why. The testcase passes even when my clone.S patch is not installed. The testcase looks logically similarly to the elfutils testcases that are failing. Maybe there is a subtle difference in how the glibc unwinding works versus the elfutils unwinding? I don't have good gdb pthread support yet, so I haven't found a way to debug this. Anyways, I don't know if the testcase is useful or not. If the testcase isn't useful then maybe the clone.S patch is OK without a testcase? Jim [BZ #24040] * elf/Makefile (CFLAGS-tst-unwind-main.c): Add -DUSE_PTHREADS=0. * elf/tst-unwind-main.c: If USE_PTHEADS, include pthread.h and error.h (func): New. (main): If USE_PTHREADS, call pthread_create to run func. Otherwise call func directly. * nptl/Makefile (tests): Add tst-unwind-thread. (CFLAGS-tst-unwind-thread.c): Define. * nptl/tst-unwind-thread.c: New file. * sysdeps/unix/sysv/linux/riscv/clone.S (__thread_start): Mark ra as undefined. (cherry picked from commit 85bd1ddbdfdfd13cfd06f7c367519b6ed3360843)
* nptl: Fix pthread_rwlock_try*lock stalls (Bug 23844)Carlos O'Donell2019-02-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For a full analysis of both the pthread_rwlock_tryrdlock() stall and the pthread_rwlock_trywrlock() stall see: https://sourceware.org/bugzilla/show_bug.cgi?id=23844#c14 In the pthread_rwlock_trydlock() function we fail to inspect for PTHREAD_RWLOCK_FUTEX_USED in __wrphase_futex and wake the waiting readers. In the pthread_rwlock_trywrlock() function we write 1 to __wrphase_futex and loose the setting of the PTHREAD_RWLOCK_FUTEX_USED bit, again failing to wake waiting readers during unlock. The fix in the case of pthread_rwlock_trydlock() is to check for PTHREAD_RWLOCK_FUTEX_USED and wake the readers. The fix in the case of pthread_rwlock_trywrlock() is to only write 1 to __wrphase_futex if we installed the write phase, since all other readers would be spinning waiting for this step. We add two new tests, one exercises the stall for pthread_rwlock_trywrlock() which is easy to exercise, and one exercises the stall for pthread_rwlock_trydlock() which is harder to exercise. The pthread_rwlock_trywrlock() test fails consistently without the fix, and passes after. The pthread_rwlock_tryrdlock() test fails roughly 5-10% of the time without the fix, and passes all the time after. Signed-off-by: Carlos O'Donell <carlos@redhat.com> Signed-off-by: Torvald Riegel <triegel@redhat.com> Signed-off-by: Rik Prohaska <prohaska7@gmail.com> Co-authored-by: Torvald Riegel <triegel@redhat.com> Co-authored-by: Rik Prohaska <prohaska7@gmail.com> (cherry picked from commit 5fc9ed4c4058bfbdf51ad6e7aac7d209b580e8c4)
* nptl: Avoid fork handler lock for async-signal-safe fork [BZ #24161]Florian Weimer2019-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 27761a1042daf01987e7d79636d0c41511c6df3c ("Refactor atfork handlers") introduced a lock, atfork_lock, around fork handler list accesses. It turns out that this lock occasionally results in self-deadlocks in malloc/tst-mallocfork2: (gdb) bt #0 __lll_lock_wait_private () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:63 #1 0x00007f160c6f927a in __run_fork_handlers (who=(unknown: 209394016), who@entry=atfork_run_prepare) at register-atfork.c:116 #2 0x00007f160c6b7897 in __libc_fork () at ../sysdeps/nptl/fork.c:58 #3 0x00000000004027d6 in sigusr1_handler (signo=<optimized out>) at tst-mallocfork2.c:80 #4 sigusr1_handler (signo=<optimized out>) at tst-mallocfork2.c:64 #5 <signal handler called> #6 0x00007f160c6f92e4 in __run_fork_handlers (who=who@entry=atfork_run_parent) at register-atfork.c:136 #7 0x00007f160c6b79a2 in __libc_fork () at ../sysdeps/nptl/fork.c:152 #8 0x0000000000402567 in do_test () at tst-mallocfork2.c:156 #9 0x0000000000402dd2 in support_test_main (argc=1, argv=0x7ffc81ef1ab0, config=config@entry=0x7ffc81ef1970) at support_test_main.c:350 #10 0x0000000000402362 in main (argc=<optimized out>, argv=<optimized out>) at ../support/test-driver.c:168 If no locking happens in the single-threaded case (where fork is expected to be async-signal-safe), this deadlock is avoided. (pthread_atfork is not required to be async-signal-safe, so a fork call from a signal handler interrupting pthread_atfork is not a problem.) (cherry picked from commit 669ff911e2571f74a2668493e326ac9a505776bd)
* NEWS: Mention bug 24112.Aurelien Jarno2019-02-041-0/+2
| | | | | The fix has been backported in the commit 37edf1d3f8ab9adefb61cc466ac52b53114fbd5b.
* CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings [BZ #20018]Florian Weimer2019-02-041-0/+4
| | | | | | | | | | | | | | | | | | The IPv4 address parser in the getaddrinfo function is changed so that it does not ignore trailing whitespace and all characters after it. For backwards compatibility, the getaddrinfo function still recognizes legacy name syntax, such as 192.000.002.010 interpreted as 192.0.2.8 (octal). This commit does not change the behavior of inet_addr and inet_aton. gethostbyname already had additional sanity checks (but is switched over to the new __inet_aton_exact function for completeness as well). To avoid sending the problematic query names over DNS, commit 6ca53a2453598804a2559a548a08424fca96434a ("resolv: Do not send queries for non-host-names in nss_dns [BZ #24112]") is needed. (cherry picked from commit 108bc4049f8ae82710aec26a92ffdb4b439c83fd)
* x86-64 memcmp: Use unsigned Jcc instructions on size [BZ #24155]H.J. Lu2019-02-041-0/+9
| | | | | | | | | | | | | | | | | | Since the size argument is unsigned. we should use unsigned Jcc instructions, instead of signed, to check size. Tested on x86-64 and x32, with and without --disable-multi-arch. [BZ #24155] CVE-2019-7309 * NEWS: Updated for CVE-2019-7309. * sysdeps/x86_64/memcmp.S: Use RDX_LP for size. Clear the upper 32 bits of RDX register for x32. Use unsigned Jcc instructions, instead of signed. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp-2. * sysdeps/x86_64/x32/tst-size_t-memcmp-2.c: New test. (cherry picked from commit 3f635fb43389b54f682fc9ed2acc0b2aaf4a923d)
* x86-64 memchr/wmemchr: Properly handle the length parameter [BZ #24097]H.J. Lu2019-02-011-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memchr/wmemchr for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ #24097] CVE-2019-6488 * sysdeps/x86_64/memchr.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memchr-avx2.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memchr and tst-size_t-wmemchr. * sysdeps/x86_64/x32/test-size_t.h: New file. * sysdeps/x86_64/x32/tst-size_t-memchr.c: Likewise. * sysdeps/x86_64/x32/tst-size_t-wmemchr.c: Likewise. (cherry picked from commit 97700a34f36721b11a754cf37a1cc40695ece1fd)
* Only build libm with -fno-math-errno (bug 24024)Aurelien Jarno2019-01-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 1294b1892e ("Add support for sqrt asm redirects") added the -fno-math-errno flag to build most of the glibc in order to enable GCC to inline math functions. Due to GCC bug #88576, saving and restoring errno around calls to malloc are optimized-out. In turn this causes strerror to set errno to ENOMEM if it get passed an invalid error number and if malloc sets errno to ENOMEM (which might happen even if it succeeds). This is not allowed by POSIX. This patch changes the build flags, building only libm with -fno-math-errno and all the remaining code with -fno-math-errno. This should be safe as libm doesn't contain any code saving and restoring errno around malloc. This patch can probably be reverted once the GCC bug is fixed and available in stable releases. Tested on x86-64, no regression in the testsuite. Changelog: [BZ #24024] * Makeconfig: Build libm with -fno-math-errno but build the remaining code with -fmath-errno. * string/Makefile [$(build-shared)] (tests): Add test-strerror-errno. [$(build-shared)] (LDLIBS-test-strerror-errno): New variable. * string/test-strerror-errno.c: New file. (cherry picked from commit 2ef427168818ce04b03cecb7b739f9db0156e3e4)
* sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O [BZ #19444]Martin Jansa2019-01-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * with -O, -O1, -Os it fails with: In file included from ../soft-fp/soft-fp.h:318, from ../sysdeps/ieee754/soft-fp/s_fdiv.c:28: ../sysdeps/ieee754/soft-fp/s_fdiv.c: In function '__fdiv': ../soft-fp/op-2.h:98:25: error: 'R_f1' may be used uninitialized in this function [-Werror=maybe-uninitialized] X##_f0 = (X##_f1 << (_FP_W_TYPE_SIZE - (N)) | X##_f0 >> (N) \ ^~ ../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f1' was declared here FP_DECL_D (R); ^ ../soft-fp/op-2.h:37:36: note: in definition of macro '_FP_FRAC_DECL_2' _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT ^ ../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL' # define FP_DECL_D(X) _FP_DECL (2, X) ^~~~~~~~ ../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D' FP_DECL_D (R); ^~~~~~~~~ ../soft-fp/op-2.h:101:17: error: 'R_f0' may be used uninitialized in this function [-Werror=maybe-uninitialized] : (X##_f0 << (_FP_W_TYPE_SIZE - (N))) != 0)); \ ^~ ../sysdeps/ieee754/soft-fp/s_fdiv.c:38:14: note: 'R_f0' was declared here FP_DECL_D (R); ^ ../soft-fp/op-2.h:37:14: note: in definition of macro '_FP_FRAC_DECL_2' _FP_W_TYPE X##_f0 _FP_ZERO_INIT, X##_f1 _FP_ZERO_INIT ^ ../soft-fp/double.h:95:24: note: in expansion of macro '_FP_DECL' # define FP_DECL_D(X) _FP_DECL (2, X) ^~~~~~~~ ../sysdeps/ieee754/soft-fp/s_fdiv.c:38:3: note: in expansion of macro 'FP_DECL_D' FP_DECL_D (R); ^~~~~~~~~ Build tested with Yocto for ARM, AARCH64, X86, X86_64, PPC, MIPS, MIPS64 with -O, -O1, -Os. For AARCH64 it needs one more fix in locale for -Os. [BZ #19444] * sysdeps/ieee754/soft-fp/s_fdiv.c: Include <libc-diag.h> and use DIAG_PUSH_NEEDS_COMMENT, DIAG_IGNORE_NEEDS_COMMENT and DIAG_POP_NEEDS_COMMENT to disable -Wmaybe-uninitialized. (cherry picked from commit 4a06ceea33ecc220bbfe264d8f1e74de2f04e90d)
* ARM: fix kernel assisted atomics with GCC 8 (bug 24034)Aurelien Jarno2019-01-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pre-ARMv7 CPUs are missing atomic compare and exchange and/or barrier instructions. Therefore those are implemented using kernel assistance, calling a kernel function at a specific address, and passing the arguments in the r0 to r4 registers. This is done by specifying registers for local variables. The a_ptr variable is placed in the r2 register and declared with __typeof (mem). According to the GCC documentation on local register variables, if mem is a constant pointer, the compiler may substitute the variable with its initializer in asm statements, which may cause the corresponding operand to appear in a different register. This happens in __libc_start_main with the pointer to the thread counter for static binaries (but not the shared ones): # ifdef SHARED unsigned int *ptr = __libc_pthread_functions.ptr_nthreads; # ifdef PTR_DEMANGLE PTR_DEMANGLE (ptr); # endif # else extern unsigned int __nptl_nthreads __attribute ((weak)); unsigned int *const ptr = &__nptl_nthreads; # endif This causes static binaries using threads to crash when the GNU libc is built with GCC 8 and most notably tst-cancel21-static. To fix that, use the same trick than for the volatile qualifier, defining a_ptr as a union. Changelog: [BZ #24034] * sysdeps/unix/sysv/linux/arm/atomic-machine.h (__arm_assisted_compare_and_exchange_val_32_acq): Use uint32_t rather than __typeof (...) for the a_ptr variable. (cherry picked from commit fe20bb1d6084bbf38fef587b0fb33eb6257cc1ed)
* riscv: Use __has_include__ to include <asm/syscalls.h> [BZ #24022]H.J. Lu2019-01-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <asm/syscalls.h> has been removed by commit 27f8899d6002e11a6e2d995e29b8deab5aa9cc25 Author: David Abdurachmanov <david.abdurachmanov@gmail.com> Date: Thu Nov 8 20:02:39 2018 +0100 riscv: add asm/unistd.h UAPI header Marcin Juszkiewicz reported issues while generating syscall table for riscv using 4.20-rc1. The patch refactors our unistd.h files to match some other architectures. - Add asm/unistd.h UAPI header, which has __ARCH_WANT_NEW_STAT only for 64-bit - Remove asm/syscalls.h UAPI header and merge to asm/unistd.h - Adjust kernel asm/unistd.h So now asm/unistd.h UAPI header should show all syscalls for riscv. <asm/syscalls.h> may be restored by Subject: [PATCH] riscv: restore asm/syscalls.h UAPI header Date: Tue, 11 Dec 2018 09:09:35 +0100 UAPI header asm/syscalls.h was merged into UAPI asm/unistd.h header, which did resolve issue with missing syscalls macros resulting in glibc (2.28) build failure. It also broke glibc in a different way: asm/syscalls.h is being used by glibc. I noticed this while doing Fedora 30/Rawhide mass rebuild. The patch returns asm/syscalls.h header and incl. it into asm/unistd.h. I plan to send a patch to glibc to use asm/unistd.h instead of asm/syscalls.h In the meantime, we use __has_include__, which was added to GCC 5, to check if <asm/syscalls.h> exists before including it. Tested with build-many-glibcs.py for riscv against kernel 4.19.12 and 4.20-rc7. [BZ #24022] * sysdeps/unix/sysv/linux/riscv/flush-icache.c: Check if <asm/syscalls.h> exists with __has_include__ before including it. (cherry picked from commit 0b9c84906f653978fb8768c7ebd0ee14a47e662e)
* intl: Do not return NULL on asprintf failure in gettext [BZ #24018]Florian Weimer2019-01-021-0/+1
| | | | | | | Fixes commit 9695dd0c9309712ed8e9c17a7040fe7af347f2dc ("DCIGETTEXT: Use getcwd, asprintf to construct absolute pathname"). (cherry picked from commit 8c1aafc1f34d090a5b41dc527c33e8687f6a1287)
* malloc: Always call memcpy in _int_realloc [BZ #24027]Florian Weimer2019-01-011-0/+1
| | | | | | | | | | This commit removes the custom memcpy implementation from _int_realloc for small chunk sizes. The ncopies variable has the wrong type, and an integer wraparound could cause the existing code to copy too few elements (leaving the new memory region mostly uninitialized). Therefore, removing this code fixes bug 24027. (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)
* powerpc: Add missing CFI register information (bug #23614)Tulio Magno Quites Machado Filho2018-12-131-0/+1
| | | | | | | | | | | | | | | Add CFI information about the offset of registers stored in the stack frame. [BZ #23614] * sysdeps/powerpc/powerpc64/addmul_1.S (FUNC): Add CFI offset for registers saved in the stack frame. * sysdeps/powerpc/powerpc64/lshift.S (__mpn_lshift): Likewise. * sysdeps/powerpc/powerpc64/mul_1.S (__mpn_mul_1): Likewise. Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> Reviewed-by: Gabriel F. T. Gomes <gabriel@inconstante.eti.br> (cherry picked from commit 1d880d4a9bf7608c2cd33bbe954ce6995f79121a)
* compat getdents64: Use correct offset for retry [BZ #23972]Florian Weimer2018-12-101-0/+1
| | | | | | | d_off is the offset of the *next* entry, not the offset of the current entry. (cherry picked from commit 8d20a2f414fa52aceef8a0e3675415df54a840db)
* CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]Florian Weimer2018-11-271-0/+6
| | | | (cherry picked from commit d527c860f5a3f0ed687bd03f0cb464612dc23408)
* Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]H.J. Lu2018-11-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linkers group input note sections with the same name into one output note section with the same name. One output note section is placed in one PT_NOTE segment. Since new linkers merge input .note.gnu.property sections into one output .note.gnu.property section, there is only one NT_GNU_PROPERTY_TYPE_0 note in one PT_NOTE segment with new linkers. Since older linkers treat input .note.gnu.property section as a generic note section and just concatenate all input .note.gnu.property sections into one output .note.gnu.property section without merging them, we may see multiple NT_GNU_PROPERTY_TYPE_0 notes in one PT_NOTE segment with older linkers. When an older linker is used to created the program on CET-enabled OS, the linker output has a single .note.gnu.property section with multiple NT_GNU_PROPERTY_TYPE_0 notes, some of which have IBT and SHSTK enable bits set even if the program isn't CET enabled. Such programs will crash on CET-enabled machines. This patch updates the note parser: 1. Skip note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed. 2. Check multiple NT_GNU_PROPERTY_TYPE_0 notes. [BZ #23509] * sysdeps/x86/dl-prop.h (_dl_process_cet_property_note): Skip note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed. Update the l_cet field when processing NT_GNU_PROPERTY_TYPE_0 note. Check multiple NT_GNU_PROPERTY_TYPE_0 notes. * sysdeps/x86/link_map.h (l_cet): Expand to 3 bits, Add lc_unknown. (cherry picked from commit d524fa6c35e675eedbd8fe6cdf4db0b49c658026)
* libanl: properly cleanup if first helper thread creation failed (bug 22927)Andreas Schwab2018-11-061-0/+1
| | | | (cherry picked from commit bd3b0fbae33a9a4cc5e2daf049443d5cf03d4251)
* x86: Fix Haswell CPU string flags (BZ#23709)Adhemerval Zanella2018-11-021-0/+1
| | | | | | | | | | | | | | | | | | | | | Th commit 'Disable TSX on some Haswell processors.' (2702856bf4) changed the default flags for Haswell models. Previously, new models were handled by the default switch path, which assumed a Core i3/i5/i7 if AVX is available. After the patch, Haswell models (0x3f, 0x3c, 0x45, 0x46) do not set the flags Fast_Rep_String, Fast_Unaligned_Load, Fast_Unaligned_Copy, and Prefer_PMINUB_for_stringop (only the TSX one). This patch fixes it by disentangle the TSX flag handling from the memory optimization ones. The strstr case cited on patch now selects the __strstr_sse2_unaligned as expected for the Haswell cpu. Checked on x86_64-linux-gnu. [BZ #23709] * sysdeps/x86/cpu-features.c (init_cpu_features): Set TSX bits independently of other flags. (cherry picked from commit c3d8dc45c9df199b8334599a6cbd98c9950dba62)
* Fix BZ#23400 (creating temporary files in source tree), and undefined ↵Paul Pluzhnikov2018-11-021-0/+1
| | | | | | behavior in test. (cherry picked from commit 6c3a8a9d868a8deddf0d6dcc785b6d120de90523)
* i64: fix missing exp2f, log2f and powf symbols in libm.a [BZ #23822]Szabolcs Nagy2018-10-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | When new symbol versions were introduced without SVID compatible error handling the exp2f, log2f and powf symbols were accidentally removed from the ia64 lim.a. The regression was introduced by the commits f5f0f5265162fe6f4f238abcd3086985f7c38d6d New expf and exp2f version without SVID compat wrapper 72d3d281080be9f674982067d72874fd6cdb4b64 New symbol version for logf, log2f and powf without SVID compat With WEAK_LIBM_ENTRY(foo), there is a hidden __foo and weak foo symbol definition in both SHARED and !SHARED build. [BZ #23822] * sysdeps/ia64/fpu/e_exp2f.S (exp2f): Use WEAK_LIBM_ENTRY. * sysdeps/ia64/fpu/e_log2f.S (log2f): Likewise. * sysdeps/ia64/fpu/e_exp2f.S (powf): Likewise. (cherry picked from commit ba5b14c7613980dfefcad6b6e88f913e5f596c59)
* conform: XFAIL siginfo_t si_band test on sparc64Florian Weimer2018-10-261-0/+1
| | | | | | | We can use long int on sparcv9, but on sparc64, we must match the int type used by the kernel (and not long int, as in POSIX). (cherry picked from commit 7c5e34d7f1b8f8f5acd94c2b885ae13b85414dcd)
* signal: Use correct type for si_band in siginfo_t [BZ #23562]Ilya Yu. Malakhov2018-10-221-0/+1
| | | | (cherry picked from commit f997b4be18f7e57d757d39e42f7715db26528aa0)
* kl_GL: Fix spelling of Sunday, should be "sapaat" (bug 20209).aaribaud/2.28/masterRafal Luzynski2018-10-091-0/+1
| | | | | | | | | | | | | Although CLDR says otherwise, it is confirmed by Oqaasileriffik, the official Greenlandic language regulator, that this change is correct. [BZ #20209] * localedata/locales/kl_GL: (abday): Fix spelling of Sun (Sunday), should be "sap" rather than "sab". (day): Fix spelling of Sunday, should be "sapaat" rather than "sabaat". (cherry picked from commit dae3ed958c3d0090838e49ff4f78c201262b1cf0)
* Fix misreported errno on preadv2/pwritev2 (BZ#23579)Adhemerval Zanella2018-09-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fallback code of Linux wrapper for preadv2/pwritev2 executes regardless of the errno code for preadv2, instead of the case where the syscall is not supported. This fixes it by calling the fallback code iff errno is ENOSYS. The patch also adds tests for both invalid file descriptor and invalid iov_len and vector count. The only discrepancy between preadv2 and fallback code regarding error reporting is when an invalid flags are used. The fallback code bails out earlier with ENOTSUP instead of EINVAL/EBADF when the syscall is used. Checked on x86_64-linux-gnu on a 4.4.0 and 4.15.0 kernel. [BZ #23579] * misc/tst-preadvwritev2-common.c (do_test_with_invalid_fd): New test. * misc/tst-preadvwritev2.c, misc/tst-preadvwritev64v2.c (do_test): Call do_test_with_invalid_fd. * sysdeps/unix/sysv/linux/preadv2.c (preadv2): Use fallback code iff errno is ENOSYS. * sysdeps/unix/sysv/linux/preadv64v2.c (preadv64v2): Likewise. * sysdeps/unix/sysv/linux/pwritev2.c (pwritev2): Likewise. * sysdeps/unix/sysv/linux/pwritev64v2.c (pwritev64v2): Likewise. (cherry picked from commit 7a16bdbb9ff4122af0a28dc20996c95352011fdd)
* Fix stack overflow in tst-setcontext9 (bug 23717)Andreas Schwab2018-09-271-0/+1
| | | | | | | | The function f1a, executed on a stack of size 32k, allocates an object of size 32k on the stack. Make the stack variables static to reduce excessive stack usage. (cherry picked from commit f841c97e515a1673485a2b12b3c280073d737890)
* i386: Use ENTRY and END in start.S [BZ #23606]H.J. Lu2018-09-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wrapping the _start function with ENTRY and END to insert ENDBR32 at function entry when CET is enabled. Since _start now includes CFI, without "cfi_undefined (eip)", unwinder may not terminate at _start and we will get Program received signal SIGSEGV, Segmentation fault. 0xf7dc661e in ?? () from /lib/libgcc_s.so.1 Missing separate debuginfos, use: dnf debuginfo-install libgcc-8.2.1-3.0.fc28.i686 (gdb) bt #0 0xf7dc661e in ?? () from /lib/libgcc_s.so.1 #1 0xf7dc7c18 in _Unwind_Backtrace () from /lib/libgcc_s.so.1 #2 0xf7f0d809 in __GI___backtrace (array=array@entry=0xffffc7d0, size=size@entry=20) at ../sysdeps/i386/backtrace.c:127 #3 0x08049254 in compare (p1=p1@entry=0xffffcad0, p2=p2@entry=0xffffcad4) at backtrace-tst.c:12 #4 0xf7e2a28c in msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=2) at msort.c:65 #5 0xf7e29f64 in msort_with_tmp (n=2, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #6 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=5) at msort.c:53 #7 0xf7e29f64 in msort_with_tmp (n=5, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #8 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=10) at msort.c:53 #9 0xf7e29f64 in msort_with_tmp (n=10, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #10 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=20) at msort.c:53 #11 0xf7e2a5b6 in msort_with_tmp (n=20, b=0xffffcad0, p=0xffffca5c) at msort.c:297 #12 __GI___qsort_r (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4, cmp=cmp@entry=0x8049230 <compare>, arg=arg@entry=0x0) at msort.c:297 #13 0xf7e2a84d in __GI_qsort (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4, cmp=cmp@entry=0x8049230 <compare>) at msort.c:308 #14 0x080490f6 in main (argc=2, argv=0xffffcbd4) at backtrace-tst.c:39 FAIL: debug/backtrace-tst [BZ #23606] * sysdeps/i386/start.S: Include <sysdep.h> (_start): Use ENTRY/END to insert ENDBR32 at entry when CET is enabled. Add cfi_undefined (eip). Signed-off-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 5a274db4ea363d6b0b92933f085a92daaf1be2f2)
* Linux gethostid: Check for NULL value from gethostbyname_r [BZ #23679]Mingli Yu2018-09-201-0/+1
| | | | | | A NULL value can happen with certain gethostbyname_r failures. (cherry picked from commit 1214ba06e6771acb953a190091b0f6055c64fd25)
* regex: fix uninitialized memory accessPaul Eggert2018-08-281-0/+1
| | | | | | | | | | | | | | | I introduced this bug into gnulib in commit 8335a4d6c7b4448cd0bcb6d0bebf1d456bcfdb17 dated 2006-04-10; eventually it was merged into glibc. The bug was found by project-repo <bugs@feusi.co> and reported here: https://lists.gnu.org/r/sed-devel/2018-08/msg00017.html Diagnosis and draft fix reported by Assaf Gordon here: https://lists.gnu.org/r/bug-gnulib/2018-08/msg00071.html https://lists.gnu.org/r/bug-gnulib/2018-08/msg00142.html * posix/regex_internal.c (build_wcs_upper_buffer): Fix bug when mbrtowc returns 0. (cherry picked from commit bc680b336971305cb39896b30d72dc7101b62242)
View Lorry Controller Status