about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
* Linux: Detect user namespace support in io/tst-getcwd-smallbuffFlorian Weimer2022-01-241-0/+18
| | | | | | Otherwise the test fails with certain container runtimes. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Fix handling of unterminated bracket expressions in fnmatch (bug 28792)Andreas Schwab2022-01-243-3/+45
| | | | | | | When fnmatch processes a bracket expression, and eventually finds it to be unterminated, it should rescan it, treating the starting bracket as a normal character. That didn't happen when a matching character was found while scanning the bracket expression.
* realpath: Avoid overwriting preexisting error (CVE-2021-3998)Siddhesh Poyarekar2022-01-241-1/+1
| | | | | | | | | | Set errno and failure for paths that are too long only if no other error occurred earlier. Related: BZ #28770 Reviewed-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf: Add a test for PT_LOAD segments with invalid p_align [BZ #28688]H.J. Lu2022-01-244-0/+88
| | | | | | | Build tst-p_alignmod3.so with 256 byte page size and verify that it is rejected with a proper error message. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Add a test for PT_LOAD segments with p_align == 1 [BZ #28688]H.J. Lu2022-01-243-0/+67
| | | | | | | | Add tst-p_alignmod2-edit to edit the copy of tst-p_alignmod-base.so to set p_align of the first PT_LOAD segment to 1 and verify that the shared library can be loaded normally. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Add a test for PT_LOAD segments with mixed p_align [BZ #28676]H.J. Lu2022-01-246-0/+258
| | | | | | | | Add tst-p_alignmod1-edit to edit the copy of tst-p_alignmod-base.so to reduce p_align of the first PT_LOAD segment by half and verify that the shared library is mapped with the maximum p_align of all PT_LOAD segments. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Add and use link-test-modules-rpath-link [BZ #28455]H.J. Lu2022-01-245-0/+83
| | | | | | | | | | | | | DT_RUNPATH is only used to find the immediate dependencies of the executable or shared object containing the DT_RUNPATH entry: 1. Define link-test-modules-rpath-link if $(build-hardcoded-path-in-tests) is yes. 2. Use $(link-test-modules-rpath-link) in build-module-helper so that test modules can dlopen modules with DT_RUNPATH. 3. Add a test to show why link-test-modules-rpath-link is needed. This partially fixes BZ #28455.
* tst-realpath-toolong: Fix hurd buildSiddhesh Poyarekar2022-01-241-0/+4
| | | | | | Define PATH_MAX to a constant if it isn't already defined, like in hurd. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)Siddhesh Poyarekar2022-01-244-1/+260
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No valid path returned by getcwd would fit into 1 byte, so reject the size early and return NULL with errno set to ERANGE. This change is prompted by CVE-2021-3999, which describes a single byte buffer underflow and overflow when all of the following conditions are met: - The buffer size (i.e. the second argument of getcwd) is 1 byte - The current working directory is too long - '/' is also mounted on the current working directory Sequence of events: - In sysdeps/unix/sysv/linux/getcwd.c, the syscall returns ENAMETOOLONG because the linux kernel checks for name length before it checks buffer size - The code falls back to the generic getcwd in sysdeps/posix - In the generic func, the buf[0] is set to '\0' on line 250 - this while loop on line 262 is bypassed: while (!(thisdev == rootdev && thisino == rootino)) since the rootfs (/) is bind mounted onto the directory and the flow goes on to line 449, where it puts a '/' in the byte before the buffer. - Finally on line 458, it moves 2 bytes (the underflowed byte and the '\0') to the buf[0] and buf[1], resulting in a 1 byte buffer overflow. - buf is returned on line 469 and errno is not set. This resolves BZ #28769. Reviewed-by: Andreas Schwab <schwab@linux-m68k.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Qualys Security Advisory <qsa@qualys.com> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Add valgrind smoke testAlexandra Hájková2022-01-223-0/+102
| | | | | | | | | | Check if whether valgrind is available in the test environment. If not, skip the test. Run smoke tests with valgrind to verify dynamic loader. First, check if algrind works with the system ld.so in the test environment. Then run the actual test inside the test environment, using the just build ld.so and new libraries. Co-authored-by: Mark Wielaard <mark@klomp.org>
* htl: Fix cleaning the reply portSamuel Thibault2022-01-227-34/+44
| | | | | | | | | | | | | If any RPC fails, the reply port will already be deallocated. __pthread_thread_terminate thus has to defer taking its name until the very last __thread_terminate_release which doesn't reply a message. But then we have to read from the pthread structure. This introduces __pthread_dealloc_finish() which does the recording of the thread termination, so the slot can be reused really only just before the __thread_terminate_release call. Only the real thread can set it, so let's decouple this from the pthread_state by just removing the PTHREAD_TERMINATED state and add a terminated field.
* elf: Properly align all PT_LOAD segments [BZ #28676]H.J. Lu2022-01-211-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linker may set p_align of a PT_LOAD segment larger than p_align of the first PT_LOAD segment to satisfy a section alignment: Elf file type is DYN (Shared object file) Entry point 0x0 There are 10 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000834 0x0000000000000834 R E 0x1000 LOAD 0x0000000000000e00 0x0000000000001e00 0x0000000000001e00 0x0000000000000230 0x0000000000000230 RW 0x1000 LOAD 0x0000000000400000 0x0000000000400000 0x0000000000400000 0x0000000000000004 0x0000000000000008 RW 0x400000 ... Section to Segment mapping: Segment Sections... 00 .note.gnu.property .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame 01 .init_array .fini_array .data.rel.ro .dynamic .got .got.plt 02 .data .bss We should align the first PT_LOAD segment to the maximum p_align of all PT_LOAD segments, similar to the kernel commit: commit ce81bb256a224259ab686742a6284930cbe4f1fa Author: Chris Kennelly <ckennelly@google.com> Date: Thu Oct 15 20:12:32 2020 -0700 fs/binfmt_elf: use PT_LOAD p_align values for suitable start address This fixes BZ #28676. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]Siddhesh Poyarekar2022-01-214-2/+64
| | | | | | | | | | | | | | realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* support: Add helpers to create paths longer than PATH_MAXSiddhesh Poyarekar2022-01-212-9/+159
| | | | | | | | | Add new helpers support_create_and_chdir_toolong_temp_directory and support_chdir_toolong_temp_directory to create and descend into directory trees longer than PATH_MAX. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* nptl: Effectively skip CAS in spinlock loopJangwoong Kim2022-01-201-3/+2
| | | | | | | | | | | | | | | | The commit: "Add LLL_MUTEX_READ_LOCK [BZ #28537]" SHA1: d672a98a1af106bd68deb15576710cd61363f7a6 introduced LLL_MUTEX_READ_LOCK, to skip CAS in spinlock loop if atomic load fails. But, "continue" inside of do-while loop does not skip the evaluation of escape expression, thus CAS is not skipped. Replace do-while with while and skip LLL_MUTEX_TRYLOCK if LLL_MUTEX_READ_LOCK fails. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* mips: Move DT_MIPS into <ldsodefs.h>Florian Weimer2022-01-192-4/+4
| | | | | | | ELF_MACHINE_XHASH_SETUP in that file needs it. Fixes commit c90363403b57b3b7919061851cb3e6d9c85e784a ("elf: Move _dl_setup_hash to its own file").
* x86_64: Document libmvec vector functions accuracy [BZ #28766]Sunil K Pandey2022-01-191-2/+3
| | | | | | | Document maximum 4 ulps accuracy for x86_64 libmvec functions. This fixes BZ #28766. Reviewed-By: Paul Zimmermann <Paul.Zimmermann@inria.fr>
* x86: Black list more Intel CPUs for TSX [BZ #27398]H.J. Lu2022-01-181-3/+31
| | | | | | | | | | Disable TSX and enable RTM_ALWAYS_ABORT for Intel CPUs listed in: https://www.intel.com/content/www/us/en/support/articles/000059422/processors.html This fixes BZ #27398. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
* elf: Fix tst-align3Adhemerval Zanella2022-01-181-2/+3
| | | | | | The elf/tst-align3.c declares the function using a wrong prototype. Checked on aarch64-linux-gnu.
* elf: Move _dl_setup_hash to its own fileFlorian Weimer2022-01-183-45/+65
| | | | | | | | | And compile it with the early CFLAGS. _dl_setup_hash is called very early for the ld.so link map, so it should be compiled differently. Reviewed-by: Stefan Liebler <stli@linux.ibm.com> Tested-by: Stefan Liebler <stli@linux.ibm.com>
* htl: Fix build error in annexcSamuel Thibault2022-01-171-2/+4
| | | | | | | | | | | We were getting ../scripts/evaluate-test.sh posix/annexc $? true false > /usr/src/glibc-upstream/build/posix/annexc.test-result In file included from ../include/pthread.h:1, from <stdin>:1: ../sysdeps/htl/include/pthread.h:7:62: error: missing binary operator before token "(" 7 | # if defined __USE_EXTERN_INLINES && defined _LIBC && !IS_IN (libsupport) | ^
* elf: Reinstate tst-audit17Adhemerval Zanella2022-01-171-0/+1
| | | | | 9926f6e2eeb3 ("elf: Skip tst-auditlogmod-* if the linker doesn't support --depaudit [BZ #28 151]") dropped the test by mistake.
* x86: use default cache size if it cannot be determined [BZ #28784]Aurelien Jarno2022-01-171-4/+10
| | | | | | | | | | | | | | | | | | | | | | In some cases (e.g QEMU, non-Intel/AMD CPU) the cache information can not be retrieved and the corresponding values are set to 0. Commit 2d651eb9265d ("x86: Move x86 processor cache info to cpu_features") changed the behaviour in such case by defining the __x86_shared_cache_size and __x86_data_cache_size variables to 0 instead of using the default values. This cause an issue with the i686 SSE2 optimized bzero/routine which assumes that the cache size is at least 128 bytes, and otherwise tries to zero/set the whole address space minus 128 bytes. Fix that by restoring the original code to only update __x86_shared_cache_size and __x86_data_cache_size variables if the corresponding cache sizes are not zero. Fixes bug 28784 Fixes commit 2d651eb9265d Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* rt/tst-mqueue*: Return UNSUPPORTED when mq_open fails with ENOSYSSamuel Thibault2022-01-1710-25/+61
| | | | Rather than returning 0 or a failure.
* Linux: Add epoll_pwait2 (BZ #27359)Adhemerval Zanella2022-01-1741-1/+349
| | | | | | | | | | | | | It is similar to epoll_wait, with the difference the timeout has nanosecond resoluting by using struct timespec instead of int. Although Linux interface only provides 64 bit time_t support, old 32 bit interface is also provided (so keep in sync with current practice and to no force opt-in on 64 bit time_t). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Properly handle --disable-default-pie [BZ #28780]H.J. Lu2022-01-172-32/+55
| | | | | | | | | | | | When --disable-default-pie is used, all glibc programs and the testsuite should be built as position dependent executables (non-PIE), regardless if the build compiler supports PIE or static PIE. When --disable-default-pie is used, don't build static PIE by default. This fixes BZ #28780. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf: Fix 64 time_t support for installed statically binariesAdhemerval Zanella2022-01-176-39/+39
| | | | | | | | | | | | | | The usage of internal static symbol for statically linked binaries does not work correctly for objects built with -D_TIME_BITS=64, since the internal definition does not provide the expected aliases. This patch makes it to use the default stat functions instead (which uses the default 64 time_t alias and types). Checked on i686-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Revert "elf: Fix 64 time_t support for installed statically binaries"Adhemerval Zanella2022-01-176-39/+39
| | | | This reverts commit 0b8e83eb1455f3c0332eeb1f96fbc262fbd054e0.
* CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)Florian Weimer2022-01-174-8/+50
| | | | | | | The sunrpc function svcunix_create suffers from a stack-based buffer overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)Martin Sebor2022-01-172-1/+48
| | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)Florian Weimer2022-01-172-4/+10
| | | | | | | Processing an overlong pathname in the sunrpc clnt_create function results in a stack-based buffer overflow. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* socket: Add the __sockaddr_un_set functionFlorian Weimer2022-01-174-1/+120
| | | | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf/tst-dl_find_object: Disable subtests for non-contiguous maps (bug 28732)Florian Weimer2022-01-171-12/+17
| | | | Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* elf: Set l_contiguous to 1 for the main map in more casesFlorian Weimer2022-01-171-0/+25
| | | | | | | | | | | | | | | | | l_contiguous was not initialized at all for the main map and always 0. This commit adds code to check if the LOAD segments are adjacent to each other, and sets l_contiguous accordingly. This helps _dl_find_object because it is more efficient if the main mapping is contiguous. Note that not all (PIE or non-PIE) binaries are contiguous in this way because BFD ld creates executables with LOAD holes: ELF LOAD segments creating holes in the process image on GNU/Linux https://sourceware.org/pipermail/binutils/2022-January/119082.html https://sourceware.org/bugzilla/show_bug.cgi?id=28743 Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* elf: Introduce rtld_setup_main_mapFlorian Weimer2022-01-171-144/+159
| | | | | | | This function collects most of the processing needed to initialize the link map for the main executable. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* hurd: Make RPC input array parameters constSamuel Thibault2022-01-163-10/+10
| | | | | This follows mig's cf4bcc3f1435 ("Also add const qualifiers on server side")
* hurd: optimize exec cleanupSamuel Thibault2022-01-162-24/+28
| | | | | When ports are nul we do not need to request their deallocation. It is also useless to look for them in portnames.
* hurd: Add __rtld_execveSamuel Thibault2022-01-152-2/+126
| | | | | It trivially execs with the same dtable, portarray and intarray, and only has to take care of deallocating / destroying ports (file, notably).
* hurd: Fix exec() leak on proc_task2proc failureSamuel Thibault2022-01-151-2/+2
| | | | env is allocated after args, so should be freed before it.
* htl: Hide __pthread_attr's __schedparam type [BZ #23088]Samuel Thibault2022-01-156-79/+11
| | | | | | | | | | The content of the structure is only used internally, so we can make __pthread_attr_getschedparam and __pthread_attr_setschedparam convert between the public sched_param type and an internal __sched_param. This allows to avoid to spuriously expose the sched_param type. This fixes BZ #23088.
* htl: Clear kernel_thread field before releasing the thread structureSamuel Thibault2022-01-151-3/+3
| | | | Otherwise this is a use-after-free.
* hurd: drop SA_SIGINFO availability xfailSamuel Thibault2022-01-151-2/+1
| | | | | BZ #23089 was fixed by d865ff74ba09 ("hurd: implement SA_SIGINFO signal handlers")
* hurd: Fix timer/clock_getres crash on NULL res parameterSamuel Thibault2022-01-151-2/+5
| | | | POSIX allows res to be NULL.
* hurd: Fix pthread_kill on exiting/ted threadSamuel Thibault2022-01-152-0/+7
| | | | | | We have to drop the kernel_thread port from the thread structure, to avoid pthread_kill's call to _hurd_thread_sigstate trying to reference it and fail.
* [hurd] Drop spurious #ifdef SHAREDSamuel Thibault2022-01-151-2/+0
| | | | The whole file is already #ifdef SHARED
* [hurd] Call _dl_sort_maps_init in _dl_sysdep_startSamuel Thibault2022-01-151-0/+3
| | | | | This follows 15a0c5730d1d ("elf: Fix slow DSO sorting behavior in dynamic loader (BZ #17645)").
* elf tst-dl_find_object: Fix typoSamuel Thibault2022-01-151-1/+1
| | | | mod1 was xdlclose()d a few lines above.
* s390x: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer2022-01-141-2/+3
| | | | | | | | This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* x86: Add x86-64-vN check to early startupFlorian Weimer2022-01-142-1/+31
| | | | | | | | This ISA level covers the glibc build itself. <dl-hwcap-check.h> cannot be used because this check (by design) happens before DL_PLATFORM_INIT and the x86 CPU flags initialization. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
* powerpc64le: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer2022-01-141-4/+5
| | | | | | | | This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-08-22 16:31:48 +0000