about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
* getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999) siddhesh/realpath-and-getcwdSiddhesh Poyarekar2022-01-194-1/+264
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No valid path returned by getcwd would fit into 1 byte, so reject the size early and return NULL with errno set to ERANGE. This change is prompted by CVE-2021-3999, which describes a single byte buffer underflow and overflow when all of the following conditions are met: - The buffer size (i.e. the second argument of getcwd) is 1 byte - The current working directory is too long - '/' is also mounted on the current working directory Sequence of events: - In sysdeps/unix/sysv/linux/getcwd.c, the syscall returns ENAMETOOLONG because the linux kernel checks for name length before it checks buffer size - The code falls back to the generic getcwd in sysdeps/posix - In the generic func, the buf[0] is set to '\0' on line 250 - this while loop on line 262 is bypassed: while (!(thisdev == rootdev && thisino == rootino)) since the rootfs (/) is bind mounted onto the directory and the flow goes on to line 449, where it puts a '/' in the byte before the buffer. - Finally on line 458, it moves 2 bytes (the underflowed byte and the '\0') to the buf[0] and buf[1], resulting in a 1 byte buffer overflow. - buf is returned on line 469 and errno is not set. This resolves BZ #28769. Signed-off-by: Qualys Security Advisory <qsa@qualys.com> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]Siddhesh Poyarekar2022-01-194-2/+64
| | | | | | | | | | | | | | realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* support: Add helpers to create paths longer than PATH_MAXSiddhesh Poyarekar2022-01-192-9/+173
| | | | | | | | Add new helpers support_create_and_chdir_toolong_temp_directory and support_chdir_toolong_temp_directory to create and descend into directory trees longer than PATH_MAX. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf: Move _dl_setup_hash to its own fileFlorian Weimer2022-01-183-45/+65
| | | | | | | | | And compile it with the early CFLAGS. _dl_setup_hash is called very early for the ld.so link map, so it should be compiled differently. Reviewed-by: Stefan Liebler <stli@linux.ibm.com> Tested-by: Stefan Liebler <stli@linux.ibm.com>
* htl: Fix build error in annexcSamuel Thibault2022-01-171-2/+4
| | | | | | | | | | | We were getting ../scripts/evaluate-test.sh posix/annexc $? true false > /usr/src/glibc-upstream/build/posix/annexc.test-result In file included from ../include/pthread.h:1, from <stdin>:1: ../sysdeps/htl/include/pthread.h:7:62: error: missing binary operator before token "(" 7 | # if defined __USE_EXTERN_INLINES && defined _LIBC && !IS_IN (libsupport) | ^
* elf: Reinstate tst-audit17Adhemerval Zanella2022-01-171-0/+1
| | | | | 9926f6e2eeb3 ("elf: Skip tst-auditlogmod-* if the linker doesn't support --depaudit [BZ #28 151]") dropped the test by mistake.
* x86: use default cache size if it cannot be determined [BZ #28784]Aurelien Jarno2022-01-171-4/+10
| | | | | | | | | | | | | | | | | | | | | | In some cases (e.g QEMU, non-Intel/AMD CPU) the cache information can not be retrieved and the corresponding values are set to 0. Commit 2d651eb9265d ("x86: Move x86 processor cache info to cpu_features") changed the behaviour in such case by defining the __x86_shared_cache_size and __x86_data_cache_size variables to 0 instead of using the default values. This cause an issue with the i686 SSE2 optimized bzero/routine which assumes that the cache size is at least 128 bytes, and otherwise tries to zero/set the whole address space minus 128 bytes. Fix that by restoring the original code to only update __x86_shared_cache_size and __x86_data_cache_size variables if the corresponding cache sizes are not zero. Fixes bug 28784 Fixes commit 2d651eb9265d Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* rt/tst-mqueue*: Return UNSUPPORTED when mq_open fails with ENOSYSSamuel Thibault2022-01-1710-25/+61
| | | | Rather than returning 0 or a failure.
* Linux: Add epoll_pwait2 (BZ #27359)Adhemerval Zanella2022-01-1741-1/+349
| | | | | | | | | | | | | It is similar to epoll_wait, with the difference the timeout has nanosecond resoluting by using struct timespec instead of int. Although Linux interface only provides 64 bit time_t support, old 32 bit interface is also provided (so keep in sync with current practice and to no force opt-in on 64 bit time_t). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Properly handle --disable-default-pie [BZ #28780]H.J. Lu2022-01-172-32/+55
| | | | | | | | | | | | When --disable-default-pie is used, all glibc programs and the testsuite should be built as position dependent executables (non-PIE), regardless if the build compiler supports PIE or static PIE. When --disable-default-pie is used, don't build static PIE by default. This fixes BZ #28780. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf: Fix 64 time_t support for installed statically binariesAdhemerval Zanella2022-01-176-39/+39
| | | | | | | | | | | | | | The usage of internal static symbol for statically linked binaries does not work correctly for objects built with -D_TIME_BITS=64, since the internal definition does not provide the expected aliases. This patch makes it to use the default stat functions instead (which uses the default 64 time_t alias and types). Checked on i686-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Revert "elf: Fix 64 time_t support for installed statically binaries"Adhemerval Zanella2022-01-176-39/+39
| | | | This reverts commit 0b8e83eb1455f3c0332eeb1f96fbc262fbd054e0.
* CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)Florian Weimer2022-01-174-8/+50
| | | | | | | The sunrpc function svcunix_create suffers from a stack-based buffer overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)Martin Sebor2022-01-172-1/+48
| | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)Florian Weimer2022-01-172-4/+10
| | | | | | | Processing an overlong pathname in the sunrpc clnt_create function results in a stack-based buffer overflow. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* socket: Add the __sockaddr_un_set functionFlorian Weimer2022-01-174-1/+120
| | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf/tst-dl_find_object: Disable subtests for non-contiguous maps (bug 28732)Florian Weimer2022-01-171-12/+17
| | | | Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* elf: Set l_contiguous to 1 for the main map in more casesFlorian Weimer2022-01-171-0/+25
| | | | | | | | | | | | | | | | | l_contiguous was not initialized at all for the main map and always 0. This commit adds code to check if the LOAD segments are adjacent to each other, and sets l_contiguous accordingly. This helps _dl_find_object because it is more efficient if the main mapping is contiguous. Note that not all (PIE or non-PIE) binaries are contiguous in this way because BFD ld creates executables with LOAD holes: ELF LOAD segments creating holes in the process image on GNU/Linux https://sourceware.org/pipermail/binutils/2022-January/119082.html https://sourceware.org/bugzilla/show_bug.cgi?id=28743 Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* elf: Introduce rtld_setup_main_mapFlorian Weimer2022-01-171-144/+159
| | | | | | | This function collects most of the processing needed to initialize the link map for the main executable. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* hurd: Make RPC input array parameters constSamuel Thibault2022-01-163-10/+10
| | | | | This follows mig's cf4bcc3f1435 ("Also add const qualifiers on server side")
* hurd: optimize exec cleanupSamuel Thibault2022-01-162-24/+28
| | | | | When ports are nul we do not need to request their deallocation. It is also useless to look for them in portnames.
* hurd: Add __rtld_execveSamuel Thibault2022-01-152-2/+126
| | | | | It trivially execs with the same dtable, portarray and intarray, and only has to take care of deallocating / destroying ports (file, notably).
* hurd: Fix exec() leak on proc_task2proc failureSamuel Thibault2022-01-151-2/+2
| | | | env is allocated after args, so should be freed before it.
* htl: Hide __pthread_attr's __schedparam type [BZ #23088]Samuel Thibault2022-01-156-79/+11
| | | | | | | | | | The content of the structure is only used internally, so we can make __pthread_attr_getschedparam and __pthread_attr_setschedparam convert between the public sched_param type and an internal __sched_param. This allows to avoid to spuriously expose the sched_param type. This fixes BZ #23088.
* htl: Clear kernel_thread field before releasing the thread structureSamuel Thibault2022-01-151-3/+3
| | | | Otherwise this is a use-after-free.
* hurd: drop SA_SIGINFO availability xfailSamuel Thibault2022-01-151-2/+1
| | | | | BZ #23089 was fixed by d865ff74ba09 ("hurd: implement SA_SIGINFO signal handlers")
* hurd: Fix timer/clock_getres crash on NULL res parameterSamuel Thibault2022-01-151-2/+5
| | | | POSIX allows res to be NULL.
* hurd: Fix pthread_kill on exiting/ted threadSamuel Thibault2022-01-152-0/+7
| | | | | | We have to drop the kernel_thread port from the thread structure, to avoid pthread_kill's call to _hurd_thread_sigstate trying to reference it and fail.
* [hurd] Drop spurious #ifdef SHAREDSamuel Thibault2022-01-151-2/+0
| | | | The whole file is already #ifdef SHARED
* [hurd] Call _dl_sort_maps_init in _dl_sysdep_startSamuel Thibault2022-01-151-0/+3
| | | | | This follows 15a0c5730d1d ("elf: Fix slow DSO sorting behavior in dynamic loader (BZ #17645)").
* elf tst-dl_find_object: Fix typoSamuel Thibault2022-01-151-1/+1
| | | | mod1 was xdlclose()d a few lines above.
* s390x: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer2022-01-141-2/+3
| | | | | | | | This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* x86: Add x86-64-vN check to early startupFlorian Weimer2022-01-142-1/+31
| | | | | | | | This ISA level covers the glibc build itself. <dl-hwcap-check.h> cannot be used because this check (by design) happens before DL_PLATFORM_INIT and the x86 CPU flags initialization. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* powerpc64le: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer2022-01-141-4/+5
| | | | | | | | This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Add --with-rtld-early-cflags configure optionFlorian Weimer2022-01-147-0/+49
| | | | | Reviewed-by: H.J. Lu <hjl.tools@gmail.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* elf: Split dl-printf.c from dl-misc.cFlorian Weimer2022-01-143-277/+297
| | | | | | | This allows to use different compiler flags for the diagnostics code. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* elf/Makefile: Reflow and sort most variable assignmentsFlorian Weimer2022-01-141-102/+318
| | | | Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* Generate gcc-macros.hFlorian Weimer2022-01-141-0/+9
| | | | | | | | The file can be used to check the effect of the default compiler flags on code generation even in areas of the build that uses non-default compiler flags. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* x86: HAVE_X86_LAHF_SAHF, HAVE_X86_MOVBE and -march=x86-64-vN (bug 28782)Florian Weimer2022-01-142-4/+4
| | | | | | | | | | HAVE_X86_LAHF_SAHF is implied by x86-64-v2, and HAVE_X86_MOVBE by x86-64-v3. The individual flag does not appear in -fverbose-asm flag output even if the ISA level implies it. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* math: Add more inputs to atan2 accuracy tests [BZ #28765]Sunil K Pandey2022-01-143-4/+800
| | | | | | | | | | | | | | | This patch adds following inputs: 0x1.bcab29da0e947p-54 0x1.bc41f4d2294b8p-54 0x1.a11891ec004d4p-348 0x1.814830510be26p-348 0x1.b836ed678be29p-588 0x1.b7be6f5a03a8cp-588 0x1.a83f842ef3f73p-633 0x1.a799d8a6677ep-633 to atan2 tests and updates x86_64 double atan2 ulps. This fixes BZ #28765. Reviewed-By: Paul Zimmermann <Paul.Zimmermann@inria.fr>
* Disable debuginfod in printer tests [BZ #28757]H.J. Lu2022-01-141-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | With gdb-11.1-6.fc35.x86_64, I got FAIL: nptl/test-cond-printers FAIL: nptl/test-condattr-printers FAIL: nptl/test-mutex-printers FAIL: nptl/test-mutexattr-printers FAIL: nptl/test-rwlock-printers FAIL: nptl/test-rwlockattr-printers $ cat nptl/test-condattr-printers.out Error: Response does not match the expected pattern. Command: start Expected pattern: main Response: Temporary breakpoint 1 at 0x11d5: file test-condattr-printers.c, line 43. Starting program: /export/build/gnu/tools-build/glibc-cet-gitlab/build-x86_64-linux/nptl/test-condattr-printers This GDB supports auto-downloading debuginfo from the following URLs: https://debuginfod.fedoraproject.org/ Enable debuginfod for this session? (y or [n]) Disable debuginfod to avoid GDB messages. This fixes BZ #28757. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Update syscall lists for Linux 5.16Joseph Myers2022-01-1327-2/+29
| | | | | | | | Linux 5.16 has one new syscall, futex_waitv. Update syscall-names.list and regenerate the arch-syscall.h headers with build-many-glibcs.py update-syscalls. Tested with build-many-glibcs.py.
* i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bug 28771)Florian Weimer2022-01-134-255/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The configure check for CAN_USE_REGISTER_ASM_EBP tried to compile a simple function that uses %ebp as an inline assembly operand. If compilation failed, CAN_USE_REGISTER_ASM_EBP was set 0, which eventually had these consequences: (1) %ebx was avoided as an inline assembly operand, with an assembler macro hack to avoid unnecessary register moves. (2) %ebp was avoided as an inline assembly operand, using an out-of-line syscall function for 6-argument system calls. (1) is no longer needed for any GCC version that is supported for building glibc. %ebx can be used directly as a register operand. Therefore, this commit removes the %ebx avoidance completely. This avoids the assembler macro hack, which turns out to be incompatible with the current Systemtap probe macros (which switch to .altmacro unconditionally). (2) is still needed in many build configurations. The existing configure check cannot really capture that because the simple function succeeds to compile, while the full glibc build still fails. Therefore, this commit removes the check, the CAN_USE_REGISTER_ASM_EBP macro, and uses the out-of-line syscall function for 6-argument system calls unconditionally. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* stdlib: Fix formatting of tests list in MakefileSiddhesh Poyarekar2022-01-131-75/+77
| | | | | Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Florian Weimer <fweimer@redhat.com>
* stdlib: Sort tests in MakefileSiddhesh Poyarekar2022-01-131-24/+75
| | | | | | Put one test per line and sort them. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* x86_64: Fix SSE4.2 libmvec atan2 function accuracy [BZ #28765]Sunil K Pandey2022-01-121-148/+173
| | | | | | | | | | | | This patch fixes SSE4.2 libmvec atan2 function accuracy for following inputs to less than 4 ulps. {0x1.bcab29da0e947p-54,0x1.bc41f4d2294b8p-54} 4.19888 ulps {0x1.b836ed678be29p-588,0x1.b7be6f5a03a8cp-588} 4.09889 ulps This fixes BZ #28765. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* debug: Synchronize feature guards in fortified functions [BZ #28746]Siddhesh Poyarekar2022-01-126-15/+58
| | | | | | | | | | | | | | | | | | Some functions (e.g. stpcpy, pread64, etc.) had moved to POSIX in the main headers as they got incorporated into the standard, but their fortified variants remained under __USE_GNU. As a result, these functions did not get fortified when _GNU_SOURCE was not defined. Add test wrappers that check all functions tested in tst-chk0 at all levels with _GNU_SOURCE undefined and then use the failures to (1) exclude checks for _GNU_SOURCE functions in these tests and (2) Fix feature macro guards in the fortified function headers so that they're the same as the ones in the main headers. This fixes BZ #28746. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* debug: Autogenerate _FORTIFY_SOURCE testsSiddhesh Poyarekar2022-01-1216-67/+73
| | | | | | | | | | | | | Rename debug/tst-chk1.c to debug/tst-fortify.c and add make hackery to autogenerate tests with different macros enabled to build and run the same test with different configurations as well as different fortification levels. The change also ends up expanding the -lfs tests to include _FORTIFY_SOURCE=3. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Do not build libresolv module with 64 bit time_t flagsAdhemerval Zanella2022-01-121-1/+1
| | | | | | | It is not used to build installed programs. It also fixes resolv/tst-p_secstodate on big endian machines. Checked on i686-linux-gnu and powerpc-linux-gnu-power4.
* Revert "linux: Fix ancillary 64-bit time timestamp conversion (BZ #28349, BZ ↵Adhemerval Zanella2022-01-124-354/+5
| | | | | | #28350)" This reverts commit 21e0f45c7d73df6fe30c77ffcc9f81410e2ee369.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-05-20 06:58:35 +0000