about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
...
| * Fix string/bug-strncat1.c build with GCC 8.Joseph Myers2018-10-222-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GCC 8 warns about strncat calls with truncated output. string/bug-strncat1.c tests such a call; this patch disables the warning for it. Tested (compilation) with GCC 8 for x86_64-linux-gnu with build-many-glibcs.py (in conjunction with Martin's patch to allow glibc to build). * string/bug-strncat1.c: Include <libc-diag.h>. (main): Disable -Wstringop-truncation for strncat call for GCC 8. (cherry picked from commit ec72135e5f1d061cb5cf7cd1b855fd6290be10d9)
| * Ignore -Wrestrict for one strncat test.Joseph Myers2018-10-222-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With current GCC mainline, one strncat test involving a size close to SIZE_MAX results in a -Wrestrict warning that that buffer size would imply that the two buffers must overlap. This patch fixes the build by adding disabling of -Wrestrict (for GCC versions supporting that option) to the already-present disabling of -Wstringop-overflow= and -Warray-bounds for this test. Tested with build-many-glibcs.py that this restores the testsuite build with GCC mainline for aarch64-linux-gnu. * string/tester.c (test_strncat) [__GNUC_PREREQ (7, 0)]: Also ignore -Wrestrict for one test. (cherry picked from commit 35ebb6b0c48bc671d9c54e089884f9bf6fca540e)
| * Disable strncat test array-bounds warnings for GCC 8.Joseph Myers2018-10-222-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some strncat tests fail to build with GCC 8 because of -Warray-bounds warnings. These tests are deliberately test over-large size arguments passed to strncat, and already disable -Wstringop-overflow warnings, but now the warnings for these tests come under -Warray-bounds so that option needs disabling for them as well, which this patch does (with an update on the comments; the DIAG_IGNORE_NEEDS_COMMENT call for -Warray-bounds doesn't need to be conditional itself, because that option is supported by all versions of GCC that can build glibc). Tested compilation with build-many-glibcs.py for aarch64-linux-gnu. * string/tester.c (test_strncat): Also disable -Warray-bounds warnings for two tests. (cherry picked from commit 1421f39b7eadd3b5fbd2a3f2da1fc006b69fbc42)
| * Fix string/tester.c build with GCC 8.Joseph Myers2018-10-222-2/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GCC 8 warns about more cases of string functions truncating their output or not copying a trailing NUL byte. This patch fixes testsuite build failures caused by such warnings in string/tester.c. In general, the warnings are disabled around the relevant calls using DIAG_* macros, since the relevant cases are being deliberately tested. In one case, the warning is with -Wstringop-overflow= instead of -Wstringop-truncation; in that case, the conditional is __GNUC_PREREQ (7, 0) (being the version where -Wstringop-overflow= was introduced), to allow the conditional to be removed sooner, since it's harmless to disable the warning for a GCC version where it doesn't actually occur. In the case of warnings for strncpy calls in test_memcmp, the calls in question are changed to use memcpy, as they don't copy a trailing NUL and the point of that code is to test memcmp rather than strncpy. Tested (compilation) with GCC 8 for x86_64-linux-gnu with build-many-glibcs.py (in conjunction with Martin's patch to allow glibc to build). * string/tester.c (test_stpncpy): Disable -Wstringop-truncation for stpncpy calls for GCC 8. (test_strncat): Disable -Wstringop-truncation warning for strncat calls for GCC 8. Disable -Wstringop-overflow= warning for one strncat call for GCC 7. (test_strncpy): Disable -Wstringop-truncation warning for strncpy calls for GCC 8. (test_memcmp): Use memcpy instead of strncpy for calls not copying trailing NUL. (cherry picked from commit 2e64ec9c9eac3aeb70f7cfa2392846c87c28068e)
| * Fix nscd readlink argument aliasing (bug 22446).Joseph Myers2018-10-223-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current GCC mainline detects that nscd calls readlink with the same buffer for both input and output, which is not valid (those arguments are both restrict-qualified in POSIX). This patch makes it use a separate buffer for readlink's input (with a size that is sufficient to avoid truncation, so there should be no problems with warnings about possible truncation, though not strictly minimal, but much smaller than the buffer for output) to avoid this problem. Tested compilation for aarch64-linux-gnu with build-many-glibcs.py. [BZ #22446] * nscd/connections.c (handle_request) [SO_PEERCRED]: Use separate buffers for readlink input and output. (cherry picked from commit 49b036bce9f021ae994a85aee8b410d20b29c8b7)
| * Increase buffer size due to warning from ToT GCCSteve Ellcey2018-10-222-1/+5
| | | | | | | | | | | | * nscd/dbg_log.c (dbg_log): Increase msg buffer size. (cherry picked from commit a7e3edf4f252fb72afeb8ecca946a2d8294bb577)
| * Fix p_secstodate overflow handling (bug 22463).Joseph Myers2018-10-225-2/+107
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The resolv/res_debug.c function p_secstodate (which is a public function exported from libresolv, taking an unsigned long argument) does: struct tm timebuf; time = __gmtime_r(&clock, &timebuf); time->tm_year += 1900; time->tm_mon += 1; sprintf(output, "%04d%02d%02d%02d%02d%02d", time->tm_year, time->tm_mon, time->tm_mday, time->tm_hour, time->tm_min, time->tm_sec); If __gmtime_r returns NULL (because the year overflows the range of int), this will dereference a null pointer. Otherwise, if the computed year does not fit in four characters, this will cause a buffer overrun of the fixed-size 15-byte buffer. With current GCC mainline, there is a compilation failure because of the possible buffer overrun. I couldn't find a specification for how this function is meant to behave, but Paul pointed to RFC 4034 as relevant to the cases where this function is called from within glibc. The function's interface is inherently problematic when dates beyond Y2038 might be involved, because of the ambiguity in how to interpret 32-bit timestamps as such dates (the RFC suggests interpreting times as being within 68 years of the present date, which would mean some kind of interface whose behavior depends on the present date). This patch works on the basis of making a minimal fix in preparation for obsoleting the function. The function is made to handle times in the interval [0, 0x7fffffff] only, on all platforms, with <overflow> used as the output string in other cases (and errno set to EOVERFLOW in such cases). This seems to be a reasonable state for the function to be in when made a compat symbol by a future patch, being compatible with any existing uses for existing timestamps without trying to work for later timestamps. Results independent of the range of time_t also simplify the testcase. I couldn't persuade GCC to recognize the ranges of the struct tm fields by adding explicit range checks with a call to __builtin_unreachable if outside the range (this looks similar to <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80776>), so having added a range check on the input, this patch then disables the -Wformat-overflow= warning for the sprintf call (I prefer that to the use of strftime, as being more transparently correct without knowing what each of %m and %M etc. is). I do not know why this build failure should be new with mainline GCC (that is, I don't know what GCC change might have introduced it, when the basic functionality for such warnings was already in GCC 7). I do not know if this is a security issue (that is, if there are plausible ways in which a date before -999 or after 9999 from an untrusted source might end up in this function). The system clock is arguably an untrusted source (in that e.g. NTP is insecure), but probably not to that extent (NTP can't communicate such wild timestamps), and uses from within glibc are limited to 32-bit inputs. Tested with build-many-glibcs.py that this restores the build for arm with yesterday's mainline GCC. Also tested for x86_64 and x86. [BZ #22463] * resolv/res_debug.c: Include <libc-diag.h>. (p_secstodate): Assert time_t at least as wide as u_long. On overflow, use integer seconds since the epoch as output, or use "<overflow>" as output and set errno to EOVERFLOW if integer seconds since the epoch would be 14 or more characters. (p_secstodate) [__GNUC_PREREQ (7, 0)]: Disable -Wformat-overflow= for sprintf call. * resolv/tst-p_secstodate.c: New file. * resolv/Makefile (tests): Add tst-p_secstodate. ($(objpfx)tst-p_secstodate): Depend on $(objpfx)libresolv.so. (cherry picked from commit f120cda6072d830df92656dad0c89967547b97dc)
| * timezone: pacify GCC -Wstringop-truncationPaul Eggert2018-10-222-1/+8
| | | | | | | | | | | | | | | | Problem reported by Martin Sebor in: https://sourceware.org/ml/libc-alpha/2017-11/msg00336.html * timezone/zic.c (writezone): Use memcpy, not strncpy. (cherry picked from commit e69897bf202e18034cbef26f363bae64de70a196)
| * utmp: Avoid -Wstringop-truncation warningMartin Sebor2018-10-224-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The -Wstringop-truncation option new in GCC 8 detects common misuses of the strncat and strncpy function that may result in truncating the copied string before the terminating NUL. To avoid false positive warnings for correct code that intentionally creates sequences of characters that aren't guaranteed to be NUL-terminated, arrays that are intended to store such sequences should be decorated with a new nonstring attribute. This change add this attribute to Glibc and uses it to suppress such false positives. ChangeLog: * misc/sys/cdefs.h (__attribute_nonstring__): New macro. * sysdeps/gnu/bits/utmp.h (struct utmp): Use it. * sysdeps/unix/sysv/linux/s390/bits/utmp.h (struct utmp): Same. (cherry picked from commit 7532837d7b03b3ca5b9a63d77a5bd81dd23f3d9c)
| * Avoid use of strlen in getlogin_r (bug 22447).Joseph Myers2018-10-223-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Building glibc with current mainline GCC fails, among other reasons, because of an error for use of strlen on the nonstring ut_user field. This patch changes the problem code in getlogin_r to use __strnlen instead. It also needs to set the trailing NUL byte of the result explicitly, because of the case where ut_user does not have such a trailing NUL byte (but the result should always have one). Tested for x86_64. Also tested that, in conjunction with <https://sourceware.org/ml/libc-alpha/2017-11/msg00797.html>, it fixes the build for arm with mainline GCC. [BZ #22447] * sysdeps/unix/getlogin_r.c (__getlogin_r): Use __strnlen not strlen to compute length of ut_user and set trailing NUL byte of result explicitly. (cherry picked from commit 4bae615022cb5a5da79ccda83cc6c9ba9f2d479c)
| * signal: Use correct type for si_band in siginfo_t [BZ #23562]Ilya Yu. Malakhov2018-10-223-1/+8
| | | | | | | | (cherry picked from commit f997b4be18f7e57d757d39e42f7715db26528aa0)
| * Fix misreported errno on preadv2/pwritev2 (BZ#23579)Adhemerval Zanella2018-09-289-5/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fallback code of Linux wrapper for preadv2/pwritev2 executes regardless of the errno code for preadv2, instead of the case where the syscall is not supported. This fixes it by calling the fallback code iff errno is ENOSYS. The patch also adds tests for both invalid file descriptor and invalid iov_len and vector count. The only discrepancy between preadv2 and fallback code regarding error reporting is when an invalid flags are used. The fallback code bails out earlier with ENOTSUP instead of EINVAL/EBADF when the syscall is used. Checked on x86_64-linux-gnu on a 4.4.0 and 4.15.0 kernel. [BZ #23579] * misc/tst-preadvwritev2-common.c (do_test_with_invalid_fd): New test. * misc/tst-preadvwritev2.c, misc/tst-preadvwritev64v2.c (do_test): Call do_test_with_invalid_fd. * sysdeps/unix/sysv/linux/preadv2.c (preadv2): Use fallback code iff errno is ENOSYS. * sysdeps/unix/sysv/linux/preadv64v2.c (preadv64v2): Likewise. * sysdeps/unix/sysv/linux/pwritev2.c (pwritev2): Likewise. * sysdeps/unix/sysv/linux/pwritev64v2.c (pwritev64v2): Likewise. (cherry picked from commit 7a16bdbb9ff4122af0a28dc20996c95352011fdd)
| * preadv2/pwritev2: Handle offset == -1 [BZ #22753]Florian Weimer2018-09-2814-15/+105
| | | | | | | | | | | | Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit d4b4a00a462348750bb18544eb30853ee6ac5d10)
| * Fix segfault in maybe_script_execute.Stefan Liebler2018-09-102-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If glibc is built with gcc 8 and -march=z900, the testcase posix/tst-spawn4-compat crashes with a segfault. In function maybe_script_execute, the new_argv array is dynamically initialized on stack with (argc + 1) elements. The function wants to add _PATH_BSHELL as the first argument and writes out of bounds of new_argv. There is an off-by-one because maybe_script_execute fails to count the terminating NULL when sizing new_argv. ChangeLog: * sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute): Increment size of new_argv by one. (cherry picked from commit 28669f86f6780a18daca264f32d66b1428c9c6f1)
| * pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]Martin Kuchta2018-08-273-2/+15
| | | | | | | | (cherry picked from commit 99ea93ca31795469d2a1f1570f17a5c39c2eb7e2)
| * x86: Populate COMMON_CPUID_INDEX_80000001 for Intel CPUs [BZ #23459]H.J. Lu2018-07-294-10/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed-by: Carlos O'Donell <carlos@redhat.com> [BZ #23459] * sysdeps/x86/cpu-features.c (get_extended_indices): New function. (init_cpu_features): Call get_extended_indices for both Intel and AMD CPUs. * sysdeps/x86/cpu-features.h (COMMON_CPUID_INDEX_80000001): Remove "for AMD" comment. (cherry picked from commit be525a69a6630abc83144c0a96474f2e26da7443)
| * x86: Correct index_cpu_LZCNT [BZ #23456]H.J. Lu2018-07-293-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cpu-features.h has #define bit_cpu_LZCNT (1 << 5) #define index_cpu_LZCNT COMMON_CPUID_INDEX_1 #define reg_LZCNT But the LZCNT feature bit is in COMMON_CPUID_INDEX_80000001: Initial EAX Value: 80000001H ECX Extended Processor Signature and Feature Bits: Bit 05: LZCNT available index_cpu_LZCNT should be COMMON_CPUID_INDEX_80000001, not COMMON_CPUID_INDEX_1. The VMX feature bit is in COMMON_CPUID_INDEX_1: Initial EAX Value: 01H Feature Information Returned in the ECX Register: 5 VMX Reviewed-by: Carlos O'Donell <carlos@redhat.com> [BZ #23456] * sysdeps/x86/cpu-features.h (index_cpu_LZCNT): Set to COMMON_CPUID_INDEX_80000001. (cherry picked from commit 65d87ade1ee6f3ac099105e3511bd09bdc24cf3f)
| * conform/conformtest.pl: Escape literal braces in regular expressionsFlorian Weimer2018-07-062-13/+18
| | | | | | | | | | | | | | | | | | | | | | | | This suppresses Perl warnings like these: Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.32), passed through in regex; marked by <-- HERE in m/^element *({ <-- HERE ([^}]*)}|([^{ ]*)) *({([^}]*)}|([^{ ]*)) *([A-Za-z0-9_]*) *(.*)/ at conformtest.pl line 370. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit ddb3c626b0a159de3547d901420198b626c29554)
| * stdio-common/tst-printf.c: Remove part under a non-free license [BZ #23363]Florian Weimer2018-07-035-121/+8
| | | | | | | | | | | | | | The license does not allow modification. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 5a357506659f9a00fcf5bc9c5d8fc676175c89a7)
| * libio: Add tst-vtables, tst-vtables-interposedFlorian Weimer2018-07-035-0/+588
| | | | | | | | | | | | | | (cherry picked from commit 29055464a03c72762969a2e8734d0d05d4d70e58) Some adjustments were needed for a tricky multi-inclusion issue related to libioP.h.
| * Synchronize support/ infrastructure with masterFlorian Weimer2018-07-0317-4/+628
| | | | | | | | | | | | This commit updates the support/ subdirectory to commit 5c0202af4b3d588c04bcec7baf05706b21cd7416 on the master branch.
| * NEWS: Reorder out-of-order bugsFlorian Weimer2018-07-031-3/+3
| |
| * libio: Disable vtable validation in case of interposition [BZ #23313]Florian Weimer2018-07-033-0/+22
| | | | | | | | (cherry picked from commit c402355dfa7807b8e0adb27c009135a7e2b9f1b0)
| * Check length of ifname before copying it into to ifreq structure.Steve Ellcey2018-06-293-0/+13
| | | | | | | | | | | | | | | | [BZ #22442] * sysdeps/unix/sysv/linux/if_index.c (__if_nametoindex): Check if ifname is too long. (cherry picked from commit 2180fee114b778515b3f560e5ff1e795282e60b0)
| * getifaddrs: Don't return ifa entries with NULL names [BZ #21812]Daniel Alvarez2018-06-293-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A lookup operation in map_newlink could turn into an insert because of holes in the interface part of the map. This leads to incorrectly set the name of the interface to NULL when the interface is not present for the address being processed (most likely because the interface was added between the RTM_GETLINK and RTM_GETADDR calls to the kernel). When such changes are detected by the kernel, it'll mark the dump as "inconsistent" by setting NLM_F_DUMP_INTR flag on the next netlink message. This patch checks this condition and retries the whole operation. Hopes are that next time the interface corresponding to the address entry is present in the list and correct name is returned. (cherry picked from commit c1f86a33ca32e26a9d6e29fc961e5ecb5e2e5eb4)
| * Use _STRUCT_TIMESPEC as guard in <bits/types/struct_timespec.h> [BZ #23349]Florian Weimer2018-06-283-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | After commit d76d3703551a362b472c866b5b6089f66f8daa8e ("Fix missing timespec definition for sys/stat.h (BZ #21371)") in combination with kernel UAPI changes, GCC sanitizer builds start to fail due to a conflicting definition of struct timespec in <linux/time.h>. Use _STRUCT_TIMESPEC as the header file inclusion guard, which is already checked in the kernel header, to support including <linux/time.h> and <sys/stat.h> in the same translation unit. (cherry picked from commit c1c2848b572ea7f92b7fa81dd5b1b9ef7c69b83b)
| * Fix parameter type in C++ version of iseqsig (bug 23171)Gabriel F. T. Gomes2018-06-193-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit commit c85e54ac6cef0faed7b7ffc722f52523dec59bf5 Author: Gabriel F. T. Gomes <gabriel@inconstante.eti.br> Date: Fri Nov 3 10:44:36 2017 -0200 Provide a C++ version of iseqsig (bug 22377) mistakenly used double parameters in the long double version of iseqsig, thus causing spurious conversions to double, as reported on bug 23171. Tested for powerpc64le and x86_64. (cherry picked from commit fb0e10b8eb1ebb68c57d4551f7a95118f3c54837)
| * libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236]Florian Weimer2018-06-019-32/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These unmangled function pointers reside on the heap and could be targeted by exploit writers, effectively bypassing libio vtable validation. Instead, we ignore these pointers and always call malloc or free. In theory, this is a backwards-incompatible change, but using the global heap instead of the user-supplied callback functions should have little application impact. (The old libstdc++ implementation exposed this functionality via a public, undocumented constructor in its strstreambuf class.) (cherry picked from commit 4e8a6346cd3da2d88bbad745a1769260d36f2783)
| * Add NEWS entry for CVE-2018-11236Florian Weimer2018-05-241-0/+4
| |
| * Add references to CVE-2018-11236, CVE-2017-18269Florian Weimer2018-05-242-0/+5
| |
| * Add a test case for [BZ #23196]H.J. Lu2018-05-242-0/+53
| | | | | | | | | | | | | | | | [BZ #23196] * string/test-memcpy.c (do_test1): New function. (test_main): Call it. (cherry picked from commit ed983107bbc62245b06b99f02e69acf36a0baa3e)
| * Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)Andreas Schwab2018-05-244-2/+18
| | | | | | | | | | | | | | When compiled as mempcpy, the return value is the end of the destination buffer, thus it cannot be used to refer to the start of it. (cherry picked from commit 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e)
| * Fix path length overflow in realpath [BZ #22786]Paul Pluzhnikov2018-05-175-2/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Integer addition overflow may cause stack buffer overflow when realpath() input length is close to SSIZE_MAX. 2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com> [BZ #22786] * stdlib/canonicalize.c (__realpath): Fix overflow in path length computation. * stdlib/Makefile (test-bz22786): New test. * stdlib/test-bz22786.c: New test. (cherry picked from commit 5460617d1567657621107d895ee2dd83bc1f88f2)
| * Fix stack overflow with huge PT_NOTE segment [BZ #20419]Paul Pluzhnikov2018-05-176-4/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A PT_NOTE in a binary could be arbitratily large, so using alloca for it may cause stack overflow. If the note is larger than __MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in. 2018-05-05 Paul Pluzhnikov <ppluzhnikov@google.com> [BZ #20419] * elf/dl-load.c (open_verify): Fix stack overflow. * elf/Makefile (tst-big-note): New test. * elf/tst-big-note-lib.S: New. * elf/tst-big-note.c: New. (cherry picked from commit 0065aaaaae51cd60210ec3a7e13dddd8e01ffe2c)
| * Fix blocking pthread_join. [BZ #23137]Stefan Liebler2018-05-173-5/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On s390 (31bit) if glibc is build with -Os, pthread_join sometimes blocks indefinitely. This is e.g. observable with testcase intl/tst-gettext6. pthread_join is calling lll_wait_tid(tid), which performs the futex-wait syscall in a loop as long as tid != 0 (thread is alive). On s390 (and build with -Os), tid is loaded from memory before comparing against zero and then the tid is loaded a second time in order to pass it to the futex-wait-syscall. If the thread exits in between, then the futex-wait-syscall is called with the value zero and it waits until a futex-wake occurs. As the thread is already exited, there won't be a futex-wake. In lll_wait_tid, the tid is stored to the local variable __tid, which is then used as argument for the futex-wait-syscall. But unfortunately the compiler is allowed to reload the value from memory. With this patch, the tid is loaded with atomic_load_acquire. Then the compiler is not allowed to reload the value for __tid from memory. ChangeLog: [BZ #23137] * sysdeps/nptl/lowlevellock.h (lll_wait_tid): Use atomic_load_acquire to load __tid. (cherry picked from commit 1660901840dfc9fde6c5720a32f901af6f08f00a)
| * Fix signed integer overflow in random_r (bug 17343).Joseph Myers2018-05-173-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug 17343 reports that stdlib/random_r.c has code with undefined behavior because of signed integer overflow on int32_t. This patch changes the code so that the possibly overflowing computations use unsigned arithmetic instead. Note that the bug report refers to "Most code" in that file. The places changed in this patch are the only ones I found where I think such overflow can occur. Tested for x86_64 and x86. [BZ #17343] * stdlib/random_r.c (__random_r): Use unsigned arithmetic for possibly overflowing computations. (cherry picked from commit 8a07b0c43c46a480da070efd53a2720195e2256f)
| * i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)Adhemerval Zanella2018-05-175-1/+247
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the i386 sa_restorer field initialization for sigaction syscall for kernel with vDSO. As described in bug report, i386 Linux (and compat on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a request for stack switching if the SS segment is 'funny'. This means that anything that tries to mix glibc's signal handling with segmentation (for instance through modify_ldt syscall) is randomly broken depending on what values lands in sa_restorer. The testcase added is based on Linux test tools/testing/selftests/x86/ldt_gdt.c, more specifically in do_multicpu_tests function. The main changes are: - C11 atomics instead of plain access. - Remove x86_64 support which simplifies the syscall handling and fallbacks. - Replicate only the test required to trigger the issue. Checked on i686-linux-gnu. [BZ #21269] * sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269. * sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear sa_restorer for vDSO case. * sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file. (cherry picked from commit 68448be208ee06e76665918b37b0a57e3e00c8b4)
| * [BZ #22342] Fix netgroup cache keys.DJ Delorie2018-05-173-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unlike other nscd caches, the netgroup cache contains two types of records - those for "iterate through a netgroup" (i.e. setnetgrent()) and those for "is this user in this netgroup" (i.e. innetgr()), i.e. full and partial records. The timeout code assumes these records have the same key for the group name, so that the collection of records that is "this netgroup" can be expired as a unit. However, the keys are not the same, as the in-netgroup key is generated by nscd rather than being passed to it from elsewhere, and is generated without the trailing NUL. All other keys have the trailing NUL, and as noted in the linked BZ, debug statements confirm that two keys for the same netgroup are added to the cache with two different lengths. The result of this is that as records in the cache expire, the purge code only cleans out one of the two types of entries, resulting in stale, possibly incorrect, and possibly inconsistent cache data. The patch simply includes the existing NUL in the computation for the key length ('key' points to the char after the NUL, and 'group' to the first char of the group, so 'key-group' includes the first char to the NUL, inclusive). [BZ #22342] * nscd/netgroupcache.c (addinnetgrX): Include trailing NUL in key value. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 1c81d55fc4b07b51adf68558ba74ce975153e580)
| * Fix i386 memmove issue (bug 22644).Andrew Senkevich2018-05-174-6/+73
| | | | | | | | | | | | | | | | | | [BZ #22644] * sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed branch conditions. * string/test-memmove.c (do_test2): New testcase. (cherry picked from commit cd66c0e584c6d692bc8347b5e72723d02b8a8ada)
| * Fix crash in resolver on memory allocation failure (bug 23005)Andreas Schwab2018-05-173-0/+12
| | | | | | | | (cherry picked from commit f178e59fa5eefbbd37fde040ae8334aa5c857ee1)
| * getlogin_r: return early when linux sentinel value is setJesse Hathaway2018-05-173-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When there is no login uid Linux sets /proc/self/loginid to the sentinel value of, (uid_t) -1. If this is set we can return early and avoid needlessly looking up the sentinel value in any configured nss databases. Checked on aarch64-linux-gnu. * sysdeps/unix/sysv/linux/getlogin_r.c (__getlogin_r_loginuid): Return early when linux sentinel value is set. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit cc8a1620eb97ccddd337d157263c13c57b39ab71)
| * resolv: Fully initialize struct mmsghdr in send_dg [BZ #23037]Florian Weimer2018-05-173-19/+28
| | | | | | | | (cherry picked from commit 583a27d525ae189bdfaa6784021b92a9a1dae12e)
| * Update NEWS for bug 22343 and bug 22774Arjun Shankar2018-02-081-0/+2
| |
| * Fix integer overflows in internal memalign and malloc [BZ #22343] [BZ #22774]Arjun Shankar2018-02-085-8/+297
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When posix_memalign is called with an alignment less than MALLOC_ALIGNMENT and a requested size close to SIZE_MAX, it falls back to malloc code (because the alignment of a block returned by malloc is sufficient to satisfy the call). In this case, an integer overflow in _int_malloc leads to posix_memalign incorrectly returning successfully. Upon fixing this and writing a somewhat thorough regression test, it was discovered that when posix_memalign is called with an alignment larger than MALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size close to SIZE_MAX, a different integer overflow in _int_memalign leads to posix_memalign incorrectly returning successfully. Both integer overflows affect other memory allocation functions that use _int_malloc (one affected malloc in x86) or _int_memalign as well. This commit fixes both integer overflows. In addition to this, it adds a regression test to guard against false successful allocations by the following memory allocation functions when called with too-large allocation sizes and, where relevant, various valid alignments: malloc, realloc, calloc, reallocarray, memalign, posix_memalign, aligned_alloc, valloc, and pvalloc. (cherry picked from commit 8e448310d74b283c5cd02b9ed7fb997b47bf9b22)
* | Merge branch 'release/2.26/master' into ibm/2.26/masterTulio Magno Quites Machado Filho2018-02-02191-912/+5393
|\|
| * powerpc: Fix syscalls during early process initialization [BZ #22685]Tulio Magno Quites Machado Filho2018-01-295-4/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The tunables framework needs to execute syscall early in process initialization, before the TCB is available for consumption. This behavior conflicts with powerpc{|64|64le}'s lock elision code, that checks the TCB before trying to abort transactions immediately before executing a syscall. This patch adds a powerpc-specific implementation of __access_noerrno that does not abort transactions before the executing syscall. Tested on powerpc{|64|64le}. [BZ #22685] * sysdeps/powerpc/powerpc32/sysdep.h (ABORT_TRANSACTION_IMPL): Renamed from ABORT_TRANSACTION. (ABORT_TRANSACTION): Redirect to ABORT_TRANSACTION_IMPL. * sysdeps/powerpc/powerpc64/sysdep.h (ABORT_TRANSACTION, ABORT_TRANSACTION_IMPL): Likewise. * sysdeps/unix/sysv/linux/powerpc/not-errno.h: New file. Reuse Linux code, but remove the code that aborts transactions. Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com> Tested-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit 4612268a0ad8e3409d8ce2314dd2dd8ee0af5269)
| * Provide a C++ version of iseqsig (bug 22377)Gabriel F. T. Gomes2018-01-296-4/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In C++ mode, __MATH_TG cannot be used for defining iseqsig, because __MATH_TG relies on __builtin_types_compatible_p, which is a C-only builtin. This is true when float128 is provided as an ABI-distinct type from long double. Moreover, the comparison macros from ISO C take two floating-point arguments, which need not have the same type. Choosing what underlying function to call requires evaluating the formats of the arguments, then selecting which is wider. The macro __MATH_EVAL_FMT2 provides this information, however, only the type of the macro expansion is relevant (actually evaluating the expression would be incorrect). This patch provides a C++ version of iseqsig, in which only the type of __MATH_EVAL_FMT2 (__typeof or decltype) is used as a template parameter for __iseqsig_type. This function calls the appropriate underlying function. Tested for powerpc64le and x86_64. [BZ #22377] * math/Makefile [C++] (tests): Add test for iseqsig. * math/math.h [C++] (iseqsig): New implementation, which does not rely on __MATH_TG/__builtin_types_compatible_p. * math/test-math-iseqsig.cc: New file. * sysdeps/powerpc/powerpc64le/Makefile (CFLAGS-test-math-iseqsig.cc): New variable. (cherry picked from commit c85e54ac6cef0faed7b7ffc722f52523dec59bf5)
| * [AARCH64] Rewrite elf_machine_load_address using _DYNAMIC symbolSzabolcs Nagy2018-01-262-34/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch rewrites aarch64 elf_machine_load_address to use special _DYNAMIC symbol instead of _dl_start. The static address of _DYNAMIC symbol is stored in the first GOT entry. Here is the change which makes this solution work (part of binutils 2.24): https://sourceware.org/ml/binutils/2013-06/msg00248.html i386, x86_64 targets use the same method to do this as well. The original implementation relies on a trick that R_AARCH64_ABS32 relocation being resolved at link time and the static address fits in the 32bits. However, in LP64, normally, the address is defined to be 64 bit. Here is the C version one which should be portable in all cases. * sysdeps/aarch64/dl-machine.h (elf_machine_load_address): Use _DYNAMIC symbol to calculate load address. (cherry picked from commit a68ba2f3cd3cbe32c1f31e13c20ed13487727b32)
| * NEWS: Add an entry for [BZ #22715]H.J. Lu2018-01-191-0/+1
| |
| * x86-64: Properly align La_x86_64_retval to VEC_SIZE [BZ #22715]H.J. Lu2018-01-192-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | _dl_runtime_profile calls _dl_call_pltexit, passing a pointer to La_x86_64_retval which is allocated on stack. The lrv_vector0 field in La_x86_64_retval must be aligned to size of vector register. When allocating stack space for La_x86_64_retval, we need to make sure that the address of La_x86_64_retval + RV_VECTOR0_OFFSET is aligned to VEC_SIZE. This patch checks the alignment of the lrv_vector0 field and pads the stack space if needed. Tested with x32 and x86-64 on SSE4, AVX and AVX512 machines. It fixed FAIL: elf/tst-audit10 FAIL: elf/tst-audit4 FAIL: elf/tst-audit5 FAIL: elf/tst-audit6 FAIL: elf/tst-audit7 on x32 AVX512 machine. (cherry picked from commit 207a72e2988c6d6343f50fe0128eb4fc4edfdd15) [BZ #22715] * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_profile): Properly align La_x86_64_retval to VEC_SIZE.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-06-12 22:39:36 +0000