Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* elf: Also compile dl-misc.os with $(rtld-early-cflags)gentoo/glibc-2.38-13gentoo/2.38H.J. Lu2024-04-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also compile dl-misc.os with $(rtld-early-cflags) to avoid Program received signal SIGILL, Illegal instruction. 0x00007ffff7fd36ea in _dl_strtoul (nptr=nptr@entry=0x7fffffffe2c9 "2", endptr=endptr@entry=0x7fffffffd728) at dl-misc.c:156 156 bool positive = true; (gdb) bt #0 0x00007ffff7fd36ea in _dl_strtoul (nptr=nptr@entry=0x7fffffffe2c9 "2", endptr=endptr@entry=0x7fffffffd728) at dl-misc.c:156 #1 0x00007ffff7fdb1a9 in tunable_initialize ( cur=cur@entry=0x7ffff7ffbc00 <tunable_list+2176>, strval=strval@entry=0x7fffffffe2c9 "2", len=len@entry=1) at dl-tunables.c:131 #2 0x00007ffff7fdb3a2 in parse_tunables (valstring=<optimized out>) at dl-tunables.c:258 #3 0x00007ffff7fdb5d9 in __GI___tunables_init (envp=0x7fffffffdd58) at dl-tunables.c:288 #4 0x00007ffff7fe44c3 in _dl_sysdep_start ( start_argptr=start_argptr@entry=0x7fffffffdcb0, dl_main=dl_main@entry=0x7ffff7fe5f80 <dl_main>) at ../sysdeps/unix/sysv/linux/dl-sysdep.c:110 #5 0x00007ffff7fe5cae in _dl_start_final (arg=0x7fffffffdcb0) at rtld.c:494 #6 _dl_start (arg=0x7fffffffdcb0) at rtld.c:581 #7 0x00007ffff7fe4b38 in _start () (gdb) when setting GLIBC_TUNABLES in glibc compiled with APX. Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 049b7684c912dd32b67b1b15b0f43bf07d5f512e) (cherry picked from commit e9f05fa1c62c8044ff025963498063f73eb51c5f)
* CVE-2024-33601, CVE-2024-33602: nscd: netgroup: Use two buffers in ↵Florian Weimer2024-04-261-98/+121
| | | | | | | | | | | | | | | | | | | addgetnetgrentX (bug 31680) This avoids potential memory corruption when the underlying NSS callback function does not use the buffer space to store all strings (e.g., for constant strings). Instead of custom buffer management, two scratch buffers are used. This increases stack usage somewhat. Scratch buffer allocation failure is handled by return -1 (an invalid timeout value) instead of terminating the process. This fixes bug 31679. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit c04a21e050d64a1193a6daab872bca2528bda44b) (cherry picked from commit 71af8ca864345d39b746d5cee84b94b430fad5db)
* CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response ↵Florian Weimer2024-04-261-4/+7
| | | | | | | | | | | | | | | | | | | (bug 31678) The addgetnetgrentX call in addinnetgrX may have failed to produce a result, so the result variable in addinnetgrX can be NULL. Use db->negtimeout as the fallback value if there is no result data; the timeout is also overwritten below. Also avoid sending a second not-found response. (The client disconnects after receiving the first response, so the data stream did not go out of sync even without this fix.) It is still beneficial to add the negative response to the mapping, so that the client can get it from there in the future, instead of going through the socket. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit b048a482f088e53144d26a61c390bed0210f49f2) (cherry picked from commit 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c)
* CVE-2024-33600: nscd: Do not send missing not-found response in ↵Florian Weimer2024-04-261-8/+6
| | | | | | | | | | | addgetnetgrentX (bug 31678) If we failed to add a not-found response to the cache, the dataset point can be null, resulting in a null pointer dereference. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> (cherry picked from commit 7835b00dbce53c3c87bbbb1754a95fb5e58187aa) (cherry picked from commit 541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a)
* CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)Florian Weimer2024-04-261-2/+3
| | | | | | | | | Using alloca matches what other caches do. The request length is bounded by MAXKEYLEN. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa) (cherry picked from commit 5968aebb86164034b8f8421b4abab2f837a5bdaf)
* i386: ulp update for SSE2 --disable-multi-arch configurationsFlorian Weimer2024-04-261-0/+1
| | | | | (cherry picked from commit 3a3a4497421422aa854c855cbe5110ca7d598ffc) (cherry picked from commit 29e20bd1222cb69dcc6827e899ce7181090052dc)
* nptl: Fix tst-cancel30 on kernels without ppoll_time64 supportFlorian Weimer2024-04-261-4/+11
| | | | | | | | | | Fall back to ppoll if ppoll_time64 fails with ENOSYS. Fixes commit 370da8a121c3ba9eeb2f13da15fc0f21f4136b25 ("nptl: Fix tst-cancel30 on sparc64"). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit f4724843ada64a51d66f65d3199fe431f9d4c254) (cherry picked from commit decc9f504ae78bbee6faa49b9bca71c7eae62ea9)
* login: structs utmp, utmpx, lastlog _TIME_BITS independence (bug 30701)Florian Weimer2024-04-2618-22/+165
| | | | | | | | | | | These structs describe file formats under /var/log, and should not depend on the definition of _TIME_BITS. This is achieved by defining __WORDSIZE_TIME64_COMPAT32 to 1 on 32-bit ports that support 32-bit time_t values (where __time_t is 32 bits). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 9abdae94c7454c45e02e97e4ed1eb1b1915d13d8) (cherry picked from commit 68bff8859231787f7e19b01788cc59b673c14046)
* login: Check default sizes of structs utmp, utmpx, lastlogFlorian Weimer2024-04-2617-1/+88
| | | | | | | | | | The default <utmp-size.h> is for ports with a 64-bit time_t. Ports with a 32-bit time_t or with __WORDSIZE_TIME64_COMPAT32=1 need to override it. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 4d4da5aab936504b2d3eca3146e109630d9093c4) (cherry picked from commit 78d9f91da6682f4073f05abaf309e4ca2b746003)
* sparc: Remove 64 bit check on sparc32 wordsize (BZ 27574)Adhemerval Zanella2024-04-261-9/+4
| | | | | | | | | The sparc32 is always 32 bits. Checked on sparcv9-linux-gnu. (cherry picked from commit dd57f5e7b652772499cb220d78157c1038d24f06) (cherry picked from commit 61484011e76d2bfafbe401f7058717c2029dd155)
* iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence ↵gentoo/glibc-2.38-12Charles Fol2024-04-183-1/+144
| | | | | | | | | | | | | | | | | | | (CVE-2024-2961) ISO-2022-CN-EXT uses escape sequences to indicate character set changes (as specified by RFC 1922). While the SOdesignation has the expected bounds checks, neither SS2designation nor SS3designation have its; allowing a write overflow of 1, 2, or 3 bytes with fixed values: '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. Checked on aarch64-linux-gnu. Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada) (cherry picked from commit e1135387deded5d73924f6ca20c72a35dc8e1bda)
* powerpc: Fix ld.so address determination for PCREL mode (bug 31640)Florian Weimer2024-04-181-0/+19
| | | | | | | | | | This seems to have stopped working with some GCC 14 versions, which clobber r2. With other compilers, the kernel-provided r2 value is still available at this point. Reviewed-by: Peter Bergner <bergner@linux.ibm.com> (cherry picked from commit 14e56bd4ce15ac2d1cc43f762eb2e6b83fec1afe) (cherry picked from commit 20534f81760635f3a71fb11ba251568cdc11c6a0)
* AArch64: Check kernel version for SVE ifuncsWilco Dijkstra2024-04-185-2/+53
| | | | | | | | | | | | | | | | | | Old Linux kernels disable SVE after every system call. Calling the SVE-optimized memcpy afterwards will then cause a trap to reenable SVE. As a result, applications with a high use of syscalls may run slower with the SVE memcpy. This is true for kernels between 4.15.0 and before 6.2.0, except for 5.14.0 which was patched. Avoid this by checking the kernel version and selecting the SVE ifunc on modern kernels. Parse the kernel version reported by uname() into a 24-bit kernel.major.minor value without calling any library functions. If uname() is not supported or if the version format is not recognized, assume the kernel is modern. Tested-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 2e94e2f5d2bf2de124c8ad7da85463355e54ccb2) (cherry picked from commit 92da7c2cfeeea36d651142f47e570dd5076bc166)
* aarch64: fix check for SVE support in assemblerSzabolcs Nagy2024-04-182-4/+6
| | | | | | | | | | | | | | | Due to GCC bug 110901 -mcpu can override -march setting when compiling asm code and thus a compiler targetting a specific cpu can fail the configure check even when binutils gas supports SVE. The workaround is that explicit .arch directive overrides both -mcpu and -march, and since that's what the actual SVE memcpy uses the configure check should use that too even if the GCC issue is fixed independently. Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 73c26018ed0ecd9c807bb363cc2c2ab4aca66a82) (cherry picked from commit 1bf17ce978da71431dbd1fc3660cfae3dff0672f)
* aarch64: correct CFI in rawmemchr (bug 31113)Andreas Schwab2024-04-181-1/+1
| | | | | | | | | | The .cfi_return_column directive changes the return column for the whole FDE range. But the actual intent is to tell the unwinder that the value in x30 (lr) now resides in x15 after the move, and that is expressed by the .cfi_register directive. (cherry picked from commit 3f798427884fa57770e8e2291cf58d5918254bb5) (cherry picked from commit 168ae58e6e705a53a71850ee63ba5514fd5d7b70)
* AArch64: Remove Falkor memcpyWilco Dijkstra2024-04-188-332/+1
| | | | | | | | | | | | The latest implementations of memcpy are actually faster than the Falkor implementations [1], so remove the falkor/phecda ifuncs for memcpy and the now unused IS_FALKOR/IS_PHECDA defines. [1] https://sourceware.org/pipermail/libc-alpha/2022-December/144227.html Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 2f5524cc5381eb75fef55f7901bb907bd5628333) (cherry picked from commit a08ff922946dca0303a270bbfa2557f74caa47aa)
* AArch64: Add memset_zva64Wilco Dijkstra2024-04-186-68/+38
| | | | | | | | | | Add a specialized memset for the common ZVA size of 64 to avoid the overhead of reading the ZVA size. Since the code is identical to __memset_falkor, remove the latter. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 3d7090f14b13312320e425b27dcf0fe72de026fd) (cherry picked from commit 156e44845f4137d6d3ea6c2824dd459652a7efda)
* AArch64: Cleanup emag memsetWilco Dijkstra2024-04-184-197/+90
| | | | | | | | | Cleanup emag memset - merge the memset_base64.S file, remove the unused ZVA code (since it is disabled on emag). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 9627ab99b50d250c6dd3001a3355aa03692f7fe5) (cherry picked from commit 1521237c3211bb0b1a8f7a9c5793d382789b2b68)
* AArch64: Cleanup ifuncsWilco Dijkstra2024-04-1818-125/+41
| | | | | | | | | | Cleanup ifuncs. Remove uses of libc_hidden_builtin_def, use ENTRY rather than ENTRY_ALIGN, remove unnecessary defines and conditional compilation. Rename strlen_mte to strlen_generic. Remove rtld-memset. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 9fd3409842b3e2d31cff5dbd6f96066c430f0aa2) (cherry picked from commit 25b66e8c4a75b51b0122089cf6b99860fb05470d)
* AArch64: Add support for MOPS memcpy/memmove/memsetWilco Dijkstra2024-04-1811-1/+141
| | | | | | | | | | Add support for MOPS in cpu_features and INIT_ARCH. Add ifuncs using MOPS for memcpy, memmove and memset (use .inst for now so it works with all binutils versions without needing complex configure and conditional compilation). Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 2bd00179885928fd95fcabfafc50e7b5c6e660d2) (cherry picked from commit d8a2b56b4fdf39488eb8a94f8b1064e262708b6f)
* Add HWCAP2_MOPS from Linux 6.5 to AArch64 bits/hwcap.hJoseph Myers2024-04-181-0/+1
| | | | | | | | | | Linux 6.5 adds a new AArch64 HWCAP2 value, HWCAP2_MOPS. Add it to glibc's bits/hwcap.h. Tested with build-many-glibcs.py for aarch64-linux-gnu. (cherry picked from commit ff5d2abd18629e0efac41e31699cdff3be0e08fa) (cherry picked from commit 5456ff5d80e45741a73cf9fa792d789a1ed17a09)
* LoongArch: Correct {__ieee754, _}_scalb -> {__ieee754, _}_scalbfcaiyinyu2024-04-181-1/+1
| | | | (cherry picked from commit 0518bb0c16cb5986aaf35cf5e634964d7a06978b)
* linux: Use rseq area unconditionally in sched_getcpu (bug 31479)Florian Weimer2024-04-181-8/+0
| | | | | | | | | | | | | | | | | | | | | Originally, nptl/descr.h included <sys/rseq.h>, but we removed that in commit 2c6b4b272e6b4d07303af25709051c3e96288f2d ("nptl: Unconditionally use a 32-byte rseq area"). After that, it was not ensured that the RSEQ_SIG macro was defined during sched_getcpu.c compilation that provided a definition. This commit always checks the rseq area for CPU number information before using the other approaches. This adds an unnecessary (but well-predictable) branch on architectures which do not define RSEQ_SIG, but its cost is small compared to the system call. Most architectures that have vDSO acceleration for getcpu also have rseq support. Fixes: 2c6b4b272e6b4d07303af25709051c3e96288f2d Fixes: 1d350aa06091211863e41169729cee1bca39f72f Reviewed-by: Arjun Shankar <arjun@redhat.com> (cherry picked from commit 7a76f218677d149d8b7875b336722108239f7ee9) (cherry picked from commit 5753cda1ca0749002c4718122a9b6d5177087b7b)
* S390: Do not clobber r7 in clone [BZ #31402]Stefan Liebler2024-04-183-13/+65
| | | | | | | | | | | | | | | | Starting with commit e57d8fc97b90127de4ed3e3a9cdf663667580935 "S390: Always use svc 0" clone clobbers the call-saved register r7 in error case: function or stack is NULL. This patch restores the saved registers also in the error case. Furthermore the existing test misc/tst-clone is extended to check all error cases and that clone does not clobber registers in this error case. (cherry picked from commit 02782fd12849b6673cb5c2728cb750e8ec295aa3) Note: Added ia64 __clone2 call to tst-clone.c. (cherry picked from commit ee4806e978467d705b26ccb7dfddb9e0a710f8e4)
* malloc: Use __get_nprocs on arena_get2 (BZ 30945)gentoo/glibc-2.38-11Adhemerval Zanella2024-02-195-18/+2
| | | | | | | | | | | | | | | | | | | This restore the 2.33 semantic for arena_get2. It was changed by 11a02b035b46 to avoid arena_get2 call malloc (back when __get_nproc was refactored to use an scratch_buffer - 903bc7dcc2acafc). The __get_nproc was refactored over then and now it also avoid to call malloc. The 11a02b035b46 did not take in consideration any performance implication, which should have been discussed properly. The __get_nprocs_sched is still used as a fallback mechanism if procfs and sysfs is not acessible. Checked on x86_64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com> (cherry picked from commit 472894d2cfee5751b44c0aaa71ed87df81c8e62e) (cherry picked from commit 506e47da1d66b33e24440a495eeef85daf7f2a78)
* arm: Remove wrong ldr from _dl_start_user (BZ 31339)Adhemerval Zanella2024-02-191-1/+0
| | | | | | | | | | | | | | | | | | | | The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove _dl_skip_args usage) removed the _SKIP_ARGS literal, which was previously loader to r4 on loader _start. However, the cleanup did not remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check to skip the arguments after ld self-relocations. In my testing, the kernel initially set r4 to 0, which makes the ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4 is a callee-saved register; a different runtime might not zero initialize it and thus trigger an invalid memory access. Checked on arm-linux-gnu. Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com> Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a) (cherry picked from commit b09073e63138ce409bf6426cf820eeaa0d28ca74)
* sparc: Remove unwind information from signal return stubs [BZ #31244]Daniel Cederman2024-02-192-4/+16
| | | | | | | | | | | | | | | | | | | | The functions were previously written in C, but were not compiled with unwind information. The ENTRY/END macros includes .cfi_startproc and .cfi_endproc which adds unwind information. This caused the tests cleanup-8 and cleanup-10 in the GCC testsuite to fail. This patch adds a version of the ENTRY/END macros without the CFI instructions that can be used instead. sigaction registers a restorer address that is located two instructions before the stub function. This patch adds a two instruction padding to avoid that the unwinder accesses the unwind information from the function that the linker has placed right before it in memory. This fixes an issue with pthread_cancel that caused tst-mutex8-static (and other tests) to fail. Signed-off-by: Daniel Cederman <cederman@gaisler.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 7bd06985c0a143cdcba2762bfe020e53514a53de) (cherry picked from commit 0c5e5bace57578ed3e28eb89ee2d2b31b74c4ecc)
* sparc: Fix sparc64 memmove length comparison (BZ 31266)Adhemerval Zanella2024-02-191-1/+1
| | | | | | | | | | | The small counts copy bytes comparsion should be unsigned (as the memmove size argument). It fixes string/tst-memmove-overflow on sparcv9, where the input size triggers an invalid code path. Checked on sparc64-linux-gnu and sparcv9-linux-gnu. (cherry picked from commit 926a4bdbb5fc8955570208b5571b2d04c6ffbd1d) (cherry picked from commit aac57faf5425b472a72132b09f4b3a2aa1f77a63)
* sparc64: Remove unwind information from signal return stubs [BZ#31244]Adhemerval Zanella2024-02-191-2/+5
| | | | | | | | | | | | | | | | Similar to sparc32 fix, remove the unwind information on the signal return stubs. This fixes the regressions: FAIL: nptl/tst-cancel24-static FAIL: nptl/tst-cond8-static FAIL: nptl/tst-mutex8-static FAIL: nptl/tst-mutexpi8-static FAIL: nptl/tst-mutexpi9 On sparc64-linux-gnu. (cherry picked from commit 369efd817780276dbe0ecf8be6e1f354bdbc9857) (cherry picked from commit 0e383d2d4e7c08b36ad3edb30c072a3dc4d26ed8)
* sparc: Fix broken memset for sparc32 [BZ #31068]Andreas Larsson2024-02-191-2/+2
| | | | | | | | | | | | | Fixes commit a61933fe27df ("sparc: Remove bzero optimization") that after moving code jumped to the wrong label 4. Verfied by successfully running string/test-memset on sparc32. Signed-off-by: Andreas Larsson <andreas@gaisler.com> Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 578190b7e43305141512dee777e4a3b3e8159393) (cherry picked from commit 6f68075869f6034f5fde3823741623d34164dc7d)
* S390: Fix building with --disable-mutli-arch [BZ #31196]Stefan Liebler2024-02-192-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | Starting with commits - 7ea510127e2067efa07865158ac92c330c379950 string: Add libc_hidden_proto for strchrnul - 22999b2f0fb62eed1af4095d062bd1272d6afeb1 string: Add libc_hidden_proto for memrchr building glibc on s390x with --disable-multi-arch fails if only the C-variant of strchrnul / memrchr is used. This is the case if gcc uses -march < z13. The build fails with: ../sysdeps/s390/strchrnul-c.c:28:49: error: ‘__strchrnul_c’ undeclared here (not in a function); did you mean ‘__strchrnul’? 28 | __hidden_ver1 (__strchrnul_c, __GI___strchrnul, __strchrnul_c); With --disable-multi-arch, __strchrnul_c is not available as string/strchrnul.c is just included without defining STRCHRNUL and thus we also don't have to create the internal hidden symbol. Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org> (cherry picked from commit cc1b91eabd806057aa7e3058a84bf129ed36e157) (cherry picked from commit 18876c9ff52c3d9aefe2c663b1a287589bebedc0)
* x86_64: Optimize ffsll function code size.Sunil K Pandey2024-02-191-5/+5
| | | | | | | | | | | | | | | | | | | Ffsll function randomly regress by ~20%, depending on how code gets aligned in memory. Ffsll function code size is 17 bytes. Since default function alignment is 16 bytes, it can load on 16, 32, 48 or 64 bytes aligned memory. When ffsll function load at 16, 32 or 64 bytes aligned memory, entire code fits in single 64 bytes cache line. When ffsll function load at 48 bytes aligned memory, it splits in two cache line, hence random regression. Ffsll function size reduction from 17 bytes to 12 bytes ensures that it will always fit in single 64 bytes cache line. This patch fixes ffsll function random performance regression. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 9d94997b5f9445afd4f2bccc5fa60ff7c4361ec1) (cherry picked from commit 30e546d76e756fe4d2d20a8b2286de4fbf30ceb5)
* Mitigation for "clone on sparc might fail with -EFAULT for no valid reason"Michael Karcher2024-02-172-0/+6
| | | | | | | | Bug: https://www.mail-archive.com/debian-glibc@lists.debian.org/msg62592.html Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 See-also: https://lore.kernel.org/sparclinux/62f9be9d-a086-4134-9a9f-5df8822708af@mkarcher.dialup.fu-berlin.de/ Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org> (cherry picked from commit fa441cd6be9a34d81306d41defeefaa2ac31d0b8)
* i386: Use generic memrchr in libc (bug 31316)Florian Weimer2024-02-172-1/+1
| | | | | | | | | Before this change, we incorrectly used the SSE2 variant in the implementation, without checking that the system actually supports SSE2. Tested-by: Sam James <sam@gentoo.org> (cherry picked from commit 0d9166c2245cad4ac520b337dee40c9a583872b6)
* syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)gentoo/glibc-2.38-10Arjun Shankar2024-01-301-1/+2
| | | | | | | | | | | __vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. This commit fixes that. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b) (cherry picked from commit d37c2b20a4787463d192b32041c3406c2bd91de0)
* syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)Arjun Shankar2024-01-301-11/+28
| | | | | | | | | | | | | | __vsyslog_internal used the return value of snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these functions (for any reason) failed and returned -1, the resulting buffer would be too small to hold output. This commit fixes that. All snprintf/vsnprintf calls are checked for negative return values and the function silently returns upon encountering them. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 7e5a0c286da33159d47d0122007aac016f3e02cd) (cherry picked from commit d0338312aace5bbfef85e03055e1212dd0e49578)
* syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)Arjun Shankar2024-01-304-15/+82
| | | | | | | | | | | | | | __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER containing a long program name failed to update the required buffer size, leading to the allocation and overflow of a too-small buffer on the heap. This commit fixes that. It also adds a new regression test that uses glibc.malloc.check. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 6bd0e4efcc78f3c0115e5ea9739a1642807450da) (cherry picked from commit 23514c72b780f3da097ecf33a793b7ba9c2070d2)
* libio: Check remaining buffer size in _IO_wdo_write (bug 31183)Florian Weimer2024-01-302-1/+2
| | | | | | | | | | | | | The multibyte character needs to fit into the remaining buffer space, not the already-written buffer space. Without the fix, we were never moving the write pointer from the start of the buffer, always using the single-character fallback buffer. Fixes commit 04b76b5aa8b2d1d19066e42dd1 ("Don't error out writing a multibyte character to an unbuffered stream (bug 17522)"). (cherry picked from commit ecc7c3deb9f347649c2078fcc0f94d4cedf92d60) (cherry picked from commit cfe121910013a46e2477562282c56ae8062089aa)
* getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163)Andreas Schwab2024-01-301-1/+8
| | | | | | | | When __resolv_context_get returns NULL due to out of memory, translate it to a return value of EAI_MEMORY. (cherry picked from commit 5eabdb6a6ac1599d23dd5966a37417215950245f) (cherry picked from commit ae1e5217021e43e1f2de443d26e87ea3adfb221c)
* Gentoo: Disable valgrind-based tests, too unreliablegentoo/glibc-2.38-9Andreas K. Hüttel2023-12-231-4/+0
| | | | Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
* NEWS: Mention bug fixes for 30745/30843gentoo/glibc-2.38-8H.J. Lu2023-12-231-0/+2
| | | | (cherry picked from commit 27339a3eb8f987eebae72b854af80256c1588ebd)
* NEWS: Mention bug fixes for 29039/30694/30709/30721H.J. Lu2023-12-231-0/+4
| | | | (cherry picked from commit d25e2c8d5cb0778ae87ad43b1f4c301abe5a932b)
* x86-64: Fix the tcb field load for x32 [BZ #31185]H.J. Lu2023-12-232-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic access the thread pointer via the tcb field in TCB: _dl_tlsdesc_undefweak: _CET_ENDBR movq 8(%rax), %rax subq %fs:0, %rax ret _dl_tlsdesc_dynamic: ... subq %fs:0, %rax movq -8(%rsp), %rdi ret Since the tcb field in TCB is a pointer, %fs:0 is a 32-bit location, not 64-bit. It should use "sub %fs:0, %RAX_LP" instead. Since _dl_tlsdesc_undefweak returns ptrdiff_t and _dl_make_tlsdesc_dynamic returns void *, RAX_LP is appropriate here for x32 and x86-64. This fixes BZ #31185. (cherry picked from commit 81be2a61dafc168327c1639e97b6dae128c7ccf3) (cherry picked from commit 968c983d43bc51f719f3e7a0fcb1bb8669b5f7c4)
* x86-64: Fix the dtv field load for x32 [BZ #31184]H.J. Lu2023-12-232-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On x32, I got FAIL: elf/tst-tlsgap $ gdb elf/tst-tlsgap ... open tst-tlsgap-mod1.so Thread 2 "tst-tlsgap" received signal SIGSEGV, Segmentation fault. [Switching to LWP 2268754] _dl_tlsdesc_dynamic () at ../sysdeps/x86_64/dl-tlsdesc.S:108 108 movq (%rsi), %rax (gdb) p/x $rsi $4 = 0xf7dbf9005655fb18 (gdb) This is caused by _dl_tlsdesc_dynamic: _CET_ENDBR /* Preserve call-clobbered registers that we modify. We need two scratch regs anyway. */ movq %rsi, -16(%rsp) movq %fs:DTV_OFFSET, %rsi Since the dtv field in TCB is a pointer, %fs:DTV_OFFSET is a 32-bit location, not 64-bit. Load the dtv field to RSI_LP instead of rsi. This fixes BZ #31184. (cherry picked from commit 3502440397bbb840e2f7223734aa5cc2cc0e29b6) (cherry picked from commit 35ea7549751d4f13a28c732e6ad68204f5e60a06)
* elf: Add TLS modid reuse test for bug 29039Szabolcs Nagy2023-12-235-0/+113
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a minimal regression test for bug 29039 which only affects targets with TLSDESC and a reproducer requires that 1) Have modid gaps (closed modules) with old generation. 2) Update a DTV to a newer generation (needs a newer dlopen). 3) But do not update the closed gap entry in that DTV. 4) Reuse the modid gap for a new module (another dlopen). 5) Use dynamic TLSDESC in that new module with old generation (bug). 6) Access TLS via this TLSDESC and the now outdated DTV. However step (3) in practice rarely happens: during DTV update the entries for closed modids are initialized to "unallocated" and then dynamic TLSDESC calls __tls_get_addr independently of its generation. The only exception to this is DTV setup at thread creation (gaps are initialized to NULL instead of unallocated) or DTV resize where the gap entries are outside the previous DTV array (again NULL instead of unallocated, and this requires loading > DTV_SURPLUS modules). So the bug can only cause NULL (+ offset) dereference, not use after free. And the easiest way to get (3) is via thread creation. Note that step (5) requires that the newly loaded module has larger TLS than the remaining optional static TLS. And for (6) there cannot be other TLS access or dlopen in the thread that updates the DTV. Tested on aarch64-linux-gnu. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 980450f12685326729d63ff72e93a996113bf073) (cherry picked from commit 0de9082ed8d8f149ca87d569a73692046e236c18)
* elf: Fix TLS modid reuse generation assignment (BZ 29039)Hector Martin2023-12-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | _dl_assign_tls_modid() assigns a slotinfo entry for a new module, but does *not* do anything to the generation counter. The first time this happens, the generation is zero and map_generation() returns the current generation to be used during relocation processing. However, if a slotinfo entry is later reused, it will already have a generation assigned. If this generation has fallen behind the current global max generation, then this causes an obsolete generation to be assigned during relocation processing, as map_generation() returns this generation if nonzero. _dl_add_to_slotinfo() eventually resets the generation, but by then it is too late. This causes DTV updates to be skipped, leading to NULL or broken TLS slot pointers and segfaults. Fix this by resetting the generation to zero in _dl_assign_tls_modid(), so it behaves the same as the first time a slot is assigned. _dl_add_to_slotinfo() will still assign the correct static generation later during module load, but relocation processing will no longer use an obsolete generation. Note that slotinfo entry (aka modid) reuse typically happens after a dlclose and only TLS access via dynamic tlsdesc is affected. Because tlsdesc is optimized to use the optional part of static TLS, dynamic tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls tunable to a large enough value, or by LD_PRELOAD-ing the affected modules. Fixes bug 29039. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 3921c5b40f293c57cb326f58713c924b0662ef59) (cherry picked from commit ccdc4cba07684fe1397e1f5f134a0a827af98c04)
* LoongArch: Delete excessively allocated memory.caiyinyu2023-12-231-34/+34
| | | | | | Backported from glibc 2.39 development. (cherry picked from commit 44f757a6364a546359809d48c76b3debd26e77d4)
* elf: Fix wrong break removal from 8ee878592cAdhemerval Zanella2023-12-231-0/+1
| | | | | | Reported-by: Alexander Monakov <amonakov@ispras.ru> (cherry picked from commit 546a1ba664626603660b595662249d524e429013) (cherry picked from commit bf5aa419cbf545d2cd09dc097e518033d6e4df5e)
* sysdeps: sem_open: Clear O_CREAT when semaphore file is expected to exist ↵Sergio Durigan Junior2023-12-232-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [BZ #30789] When invoking sem_open with O_CREAT as one of its flags, we'll end up in the second part of sem_open's "if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0)", which means that we don't expect the semaphore file to exist. In that part, open_flags is initialized as "O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC" and there's an attempt to open(2) the file, which will likely fail because it won't exist. After that first (expected) failure, some cleanup is done and we go back to the label "try_again", which lives in the first part of the aforementioned "if". The problem is that, in that part of the code, we expect the semaphore file to exist, and as such O_CREAT (this time the flag we pass to open(2)) needs to be cleaned from open_flags, otherwise we'll see another failure (this time unexpected) when trying to open the file, which will lead the call to sem_open to fail as well. This can cause very strange bugs, especially with OpenMPI, which makes extensive use of semaphores. Fix the bug by simplifying the logic when choosing open(2) flags and making sure O_CREAT is not set when the semaphore file is expected to exist. A regression test for this issue would require a complex and cpu time consuming logic, since to trigger the wrong code path is not straightforward due the racy condition. There is a somewhat reliable reproducer in the bug, but it requires using OpenMPI. This resolves BZ #30789. See also: https://bugs.launchpad.net/ubuntu/+source/h5py/+bug/2031912 Signed-off-by: Sergio Durigan Junior <sergiodj@sergiodj.net> Co-Authored-By: Simon Chopin <simon.chopin@canonical.com> Co-Authored-By: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org> Fixes: 533deafbdf189f5fbb280c28562dd43ace2f4b0f ("Use O_CLOEXEC in more places (BZ #15722)") (cherry picked from commit f957f47df75b9fab995754011491edebc6feb147) (cherry picked from commit 63dbbc5c52f9823f86270f32fce20d1e91cdf484)
* Revert "elf: Move l_init_called_next to old place of l_text_end in link map"gentoo/glibc-2.38-7Florian Weimer2023-10-261-4/+4
| | | | | | | This reverts commit d3ba6c1333b10680ce5900a628108507d9d4b844. Reason: Preserve internal ABI. (cherry picked from commit 1e04dcec491bd8f48b5b74ce3e8414132578a645)