about summary refs log tree commit diff
path: root/libio
Commit message (Collapse)AuthorAgeFilesLines
* libio/bug-wsetpos: Make the error message match the causing functionMaciej W. Rozycki4 days1-1/+1
| | | | | | | | | This test case calls `fopen': FILE *fp = fopen (temp_file, "r"); however if that fails it reports `fdopen' being the origin of the error. Adjust the message to say `fopen' then.
* Add crt1-2.0.o for glibc 2.0 compatibility testsH.J. Lu10 days2-0/+58
| | | | | | | | | Starting from glibc 2.1, crt1.o contains _IO_stdin_used which is checked by _IO_check_libio to provide binary compatibility for glibc 2.0. Add crt1-2.0.o for tests against glibc 2.0. Define tests-2.0 for glibc 2.0 compatibility tests. Add and update glibc 2.0 compatibility tests for stderr, matherr and pthread_kill. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* libio: Sort test variables in MakefileH.J. Lu2024-04-301-20/+84
| | | | | Sort test variables in libio/Makefile using scripts/sort-makefile-lines.py. Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
* Revert "Allow glibc to be compiled without EXEC_PAGESIZE"Samuel Thibault2024-04-221-1/+1
| | | | | | This reverts commit 49aa652db810ebdca3a662ebd5b0468bd08ec688. This is still being discussed.
* posix: Sync tempname with gnulibAdhemerval Zanella2024-04-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | The gnulib version contains an important change (9ce573cde), which fixes some problems with multithreading, entropy loss, and ASLR leak nfo. It also fixes an issue where getrandom is not being used on some new files generation (only for __GT_NOCREATE on first try). The 044bf893ac removed __path_search, which is now moved to another gnulib shared files (stdio-common/tmpdir.{c,h}). Tthis patch also fixes direxists to use __stat64_time64 instead of __xstat64, and move the include of pathmax.h for !_LIBC (since it is not used by glibc). The license is also changed from GPL 3.0 to 2.1, with permission from the authors (Bruno Haible and Paul Eggert). The sync also removed the clock fallback, since clock_gettime with CLOCK_REALTIME is expected to always succeed. It syncs with gnulib commit 323834962817af7b115187e8c9a833437f8d20ec. Checked on x86_64-linux-gnu. Co-authored-by: Bruno Haible <bruno@clisp.org> Co-authored-by: Paul Eggert <eggert@cs.ucla.edu> Reviewed-by: Bruno Haible <bruno@clisp.org>
* Allow glibc to be compiled without EXEC_PAGESIZESergey Bugaev2024-03-231-1/+1
| | | | | | | | | | | | | | | | | We would like to avoid statically defining any specific page size on aarch64-gnu, and instead make sure that everything uses the dynamic page size, available via vm_page_size and GLRO(dl_pagesize). There are currently a few places in glibc that require EXEC_PAGESIZE to be defined. Per Roland's suggestion [0], drop the static GLRO(dl_pagesize) initializers (for now, only if EXEC_PAGESIZE is not defined), and don't require EXEC_PAGESIZE definition for libio to enable mmap usage. [0]: https://mail.gnu.org/archive/html/bug-hurd/2011-10/msg00035.html Signed-off-by: Sergey Bugaev <bugaevc@gmail.com> Message-ID: <20240323173301.151066-4-bugaevc@gmail.com>
* libio: Improve fortify with clangAdhemerval Zanella2024-02-271-20/+153
| | | | | | | | | | | | | | | It improve fortify checks for sprintf, vsprintf, vsnsprintf, fprintf, dprintf, asprintf, __asprintf, obstack_printf, gets, fgets, fgets_unlocked, fread, and fread_unlocked. The runtime checks have similar support coverage as with GCC. For function with variadic argument (sprintf, snprintf, fprintf, printf, dprintf, asprintf, __asprintf, obstack_printf) the fortify wrapper calls the va_arg version since clang does not support __va_arg_pack. Checked on aarch64, armhf, x86_64, and i686. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Refer to C23 in place of C2X in glibcJoseph Myers2024-02-012-7/+7
| | | | | | | | | | | | | | | WG14 decided to use the name C23 as the informal name of the next revision of the C standard (notwithstanding the publication date in 2024). Update references to C2X in glibc to use the C23 name. This is intended to update everything *except* where it involves renaming files (the changes involving renaming tests are intended to be done separately). In the case of the _ISOC2X_SOURCE feature test macro - the only user-visible interface involved - support for that macro is kept for backwards compatibility, while adding _ISOC23_SOURCE. Tested for x86_64.
* libio: Check remaining buffer size in _IO_wdo_write (bug 31183)Florian Weimer2024-01-021-1/+1
| | | | | | | | | | The multibyte character needs to fit into the remaining buffer space, not the already-written buffer space. Without the fix, we were never moving the write pointer from the start of the buffer, always using the single-character fallback buffer. Fixes commit 04b76b5aa8b2d1d19066e42dd1 ("Don't error out writing a multibyte character to an unbuffered stream (bug 17522)").
* Update copyright dates with scripts/update-copyrightsPaul Eggert2024-01-01179-179/+179
|
* libio: Add nonnull attribute for most FILE * arguments in stdio.hXi Ruoyao2023-09-263-78/+99
| | | | | | | | | | | | | | | | | | | | | | During the review of a GCC analyzer test case, we found most stdio functions accepting a FILE * argument expect it to be nonnull and just segfault when the argument is NULL. Add nonnull attribute for them. fflush and fflush_unlocked are well defined when __stream is NULL so they are not touched. For fputs, fgets, fread, fwrite, fprintf, vfprintf, and their unlocked version, if __stream is empty but there is nothing to read or write, they did not segfault. But the standard disallow __stream to be empty here, so nonnull attribute is also added for them. Note that this may blow up some old code already subtly broken. Also add __nonnull for _chk variants and __fortify_function versions for them. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Alejandro Colomar <alx@kernel.org> Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* libio: Fix oversized __io_vtablesAdam Jackson2023-09-081-1/+4
| | | | | | | | | | | IO_VTABLES_LEN is the size of the struct array in bytes, not the number of __IO_jump_t's in the array. Drops just under 384kb from .rodata on LP64 machines. Fixes: 3020f72618e ("libio: Remove the usage of __libc_IO_vtables") Signed-off-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> Tested-by: Florian Weimer <fweimer@redhat.com>
* hurd: Fix tst-openlocSamuel Thibault2023-07-201-1/+2
| | | | | | | On GNU/Hurd, O_RDWR actually is O_WRONLY|O_RDONLY, so checking through bitness really is wrong. O_ACCMODE is there for this. Fixes: 5324d258427f ("fileops: Don't process ,ccs= as individual mode flags (BZ#18906)")
* fileops: Don't process ,ccs= as individual mode flags (BZ#18906)Joe Simmons-Talbott2023-07-052-1/+34
| | | | | | | | | | | In processing the first 7 individual characters of the mode for fopen if ,ccs= is used those characters will be processed as well. Stop processing individual mode flags once a comma is encountered. This has the effect of requiring ,ccs= to be the last mode flag in the mode string. Add a testcase to check that the ,ccs= mode flag is not processed as individual mode flags. Reviewed-by: DJ Delorie <dj@redhat.com>
* libio/bits/stdio2-decl.h: Avoid PLT entries with _FORTIFY_SOURCEFrédéric Bérat2023-07-051-1/+1
| | | | | | | The change is meant to avoid unwanted PLT entry for the fgets_unlocked routine when _FORTIFY_SOURCE is set. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* libio/bits/stdio2.h: Clearly separate declaration from definitionsFrédéric Bérat2023-07-052-48/+49
| | | | | | | | Move declarations from libio/bits/stdio.h to existing libio/bits/stdio2-decl.h. This will enable future use of __REDIRECT_FORTIFY in place of some __REDIRECT. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Exclude routines from fortificationFrédéric Bérat2023-07-051-2/+21
| | | | | | | | | | | | | | | | | Since the _FORTIFY_SOURCE feature uses some routines of Glibc, they need to be excluded from the fortification. On top of that: - some tests explicitly verify that some level of fortification works appropriately, we therefore shouldn't modify the level set for them. - some objects need to be build with optimization disabled, which prevents _FORTIFY_SOURCE to be used for them. Assembler files that implement architecture specific versions of the fortified routines were not excluded from _FORTIFY_SOURCE as there is no C header included that would impact their behavior. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Always do locking when accessing streams (bug 15142, bug 14697)Andreas Schwab2023-07-032-34/+10
| | | | | | Now that abort no longer calls fflush there is no reason to avoid locking the stdio streams anywhere. This fixes a conformance issue and potential heap corruption during exit.
* tests: replace system by xsystemFrédéric Bérat2023-06-191-2/+5
| | | | | | With fortification enabled, system calls return result needs to be checked, has it gets the __wur macro enabled. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* tests: replace fread by xfreadFrederic Berat2023-06-131-3/+4
| | | | | | With fortification enabled, fread calls return result needs to be checked, has it gets the __wur macro enabled. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Fix all the remaining misspellings -- BZ 25337Paul Pluzhnikov2023-06-026-6/+6
|
* tests: replace write by xwriteFrédéric Bérat2023-06-015-5/+15
| | | | | | | Using write without cheks leads to warn unused result when __wur is enabled. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* libio: Add __nonnull for FILE * arguments of fclose and freopenXi Ruoyao2023-05-161-3/+3
| | | | | | | | | | Calling fclose or freopen with a null FILE * is undefined behavior, and doing so in practice will cause a SIGSEGV. So it seems suitable for __nonnull. This will help the compiler to warn for some buggy code, like https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109570. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Mark various cold functions as __COLDSergey Bugaev2023-05-011-1/+1
| | | | | | | | | | GCC docs explicitly list perror () as a good candidate for using __attribute__ ((cold)). So apply __COLD to perror () and similar functions. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Signed-off-by: Sergey Bugaev <bugaevc@gmail.com> Message-Id: <20230429131223.2507236-3-bugaevc@gmail.com>
* <stdio.h>: Make fopencookie, vasprintf, asprintf available by defaultFlorian Weimer2023-04-061-3/+3
| | | | | | | FreeBSD makes these functions available by default, so we should not treat them as GNU-specific and restrict them to _GNU_SOURCE. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Remove unused pragma weak on vtableAdhemerval Zanella2023-04-051-2/+0
| | | | | Both _IO_file_jumps_alias and _IO_wfile_jumps_alias are defined as alias.
* system: Add "--" after "-c" for sh (BZ #28519)Joe Simmons-Talbott2023-03-281-1/+1
| | | | | | | | | | | Prevent sh from interpreting a user string as shell options if it starts with '-' or '+'. Since the version of /bin/sh used for testing system() is different from the full-fledged system /bin/sh add support to it for handling "--" after "-c". Add a testcase to ensure the expected behavior. Signed-off-by: Joe Simmons-Talbott <josimmon@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Remove the usage of __libc_IO_vtablesAdhemerval Zanella Netto2023-03-2717-416/+620
| | | | | | | | | | | | | | Instead of using a special ELF section along with a linker script directive to put the IO vtables within the RELRO section, the libio vtables are all moved to an array marked as data.relro (so linker will place in the RELRO segment without the need of extra directives). To avoid static linking namespace issues and including all vtable referenced objects, all required function pointers are set to weak alias. Checked on x86_64-linux-gnu, i686-linux-gnu, and aarch64-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* libio: Do not autogenerate stdio_lim.hAdhemerval Zanella Netto2023-03-271-7/+12
| | | | | | | | | | | | | Instead define the required fields in system dependend files. The only system dependent definition is FILENAME_MAX, which should match POSIX PATH_MAX, and it is obtained from either kernel UAPI or mach headers. Currently set pre-defined value from current kernels. It avoids a circular dependendy when including stdio.h in gen-as-const-headers files. Checked on x86_64-linux-gnu and i686-linux-gnu Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Move libc_freeres_ptrs and libc_subfreeres to hidden/weak functionsAdhemerval Zanella Netto2023-03-273-5/+5
| | | | | | | | | | | | | | | | | | | | They are both used by __libc_freeres to free all library malloc allocated resources to help tooling like mtrace or valgrind with memory leak tracking. The current scheme uses assembly markers and linker script entries to consolidate the free routine function pointers in the RELRO segment and to be freed buffers in BSS. This patch changes it to use specific free functions for libc_freeres_ptrs buffers and call the function pointer array directly with call_function_static_weak. It allows the removal of both the internal macros and the linker script sections. Checked on x86_64-linux-gnu, i686-linux-gnu, and aarch64-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* C2x scanf binary constant handlingJoseph Myers2023-03-023-11/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | C2x adds binary integer constants starting with 0b or 0B, and supports those constants for the %i scanf format (in addition to the %b format, which isn't yet implemented for scanf in glibc). Implement that scanf support for glibc. As with the strtol support, this is incompatible with previous C standard versions, in that such an input string starting with 0b or 0B was previously required to be parsed as 0 (with the rest of the input potentially matching subsequent parts of the scanf format string). Thus this patch adds 12 new __isoc23_* functions per long double format (12, 24 or 36 depending on how many long double formats the glibc configuration supports), with appropriate header redirection support (generally very closely following that for the __isoc99_* scanf functions - note that __GLIBC_USE (DEPRECATED_SCANF) takes precedence over __GLIBC_USE (C2X_STRTOL), so the case of GNU extensions to C89 continues to get old-style GNU %a and does not get this new feature). The function names would remain as __isoc23_* even if C2x ends up published in 2024 rather than 2023. When scanf %b support is added, I think it will be appropriate for all versions of scanf to follow C2x rules for inputs to the %b format (given that there are no compatibility concerns for a new format). Tested for x86_64 (full glibc testsuite). The first version was also tested for powerpc (32-bit) and powerpc64le (stdio-common/ and wcsmbs/ tests), and with build-many-glibcs.py.
* stdio: Do not ignore posix_spawn error on popen (BZ #29016)Adhemerval Zanella2023-02-141-16/+22
| | | | | | To correctly return error in case of default shell is not present. Checked on x86_64-linux-gnu.
* Replace rawmemchr (s, '\0') with strchrWilco Dijkstra2023-02-061-1/+1
| | | | | | | | | Almost all uses of rawmemchr find the end of a string. Since most targets use a generic implementation, replacing it with strchr is better since that is optimized by compilers into strlen (s) + s. Also fix the generic rawmemchr implementation to use a cast to unsigned char in the if statement. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Update number of written bytes in dprintf implementationFlorian Weimer2023-01-311-0/+1
| | | | | | | | | | | | The __printf_buffer_flush_dprintf function needs to record that the buffer has been written before reusing it. Without this accounting, dprintf always returns zero. Fixes commit 8ece45e4f586abd212d1c02d74d38ef681a45600 ("libio: Convert __vdprintf_internal to buffers"). Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* stdio-common: Handle -1 buffer size in __sprintf_chk & co (bug 30039)Florian Weimer2023-01-251-5/+10
| | | | | | | | | | | | | | | This shows up as an assertion failure when sprintf is called with a specifier like "%.8g" and libquadmath is linked in: Fatal glibc error: printf_buffer_as_file.c:31 (__printf_buffer_as_file_commit): assertion failed: file->stream._IO_write_ptr <= file->next->write_end Fix this by detecting pointer wraparound in __vsprintf_internal and saturate the addition to the end of the address space instead. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Update copyright dates with scripts/update-copyrightsJoseph Myers2023-01-06178-178/+178
|
* getdelim: ensure error indicator is set on error (bug 29917)Andreas Schwab2023-01-023-6/+48
| | | | | POSIX requires that getdelim and getline set the error indicator on the stream when an error occured, in addition to setting errno.
* libio: Convert __vswprintf_internal to buffers (bug 27857)Florian Weimer2022-12-192-85/+46
| | | | | | | Always null-terminate the buffer and set E2BIG if the buffer is too small. This fixes bug 27857. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Convert __obstack_vprintf_internal to buffers (bug 27124)Florian Weimer2022-12-191-120/+50
| | | | | | This fixes bug 27124 because the problematic built-in vtable is gone. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Convert __vdprintf_internal to buffersFlorian Weimer2022-12-191-28/+39
| | | | | | | | | The internal buffer size is set to 2048 bytes. This is less than the original BUFSIZ value used by buffered_vfprintf before the conversion, but it hopefully covers all cases where write boundaries matter. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Convert __vasprintf_internal to buffersFlorian Weimer2022-12-191-45/+96
| | | | | | | | | | The buffer resizing algorithm is slightly different. The initial buffer is on the stack, and small buffers are directly allocated on the heap using the exact required size. The overhead of the additional copy is compensated by the lowered setup cost for buffers compared to libio streams. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* libio: Convert __vsprintf_internal to buffersFlorian Weimer2022-12-191-52/+18
| | | | Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdio-common: Convert vfprintf and related functions to buffersFlorian Weimer2022-12-193-82/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vfprintf is entangled with vfwprintf (of course), __printf_fp, __printf_fphex, __vstrfmon_l_internal, and the strfrom family of functions. The latter use the internal snprintf functionality, so vsnprintf is converted as well. The simples conversion is __printf_fphex, followed by __vstrfmon_l_internal and __printf_fp, and finally __vfprintf_internal and __vfwprintf_internal. __vsnprintf_internal and strfrom* are mostly consuming the new interfaces, so they are comparatively simple. __printf_fp is a public symbol, so the FILE *-based interface had to preserved. The __printf_fp rewrite does not change the actual binary-to-decimal conversion algorithm, and digits are still not emitted directly to the target buffer. However, the staging buffer now uses bytes instead of wide characters, and one buffer copy is eliminated. The changes are at least performance-neutral in my testing. Floating point printing and snprintf improved measurably, so that this Lua script for i=1,5000000 do print(i, i * math.pi) end runs about 5% faster for me. To preserve fprintf performance for a simple "%d" format, this commit has some logic changes under LABEL (unsigned_number) to avoid additional function calls. There are certainly some very easy performance improvements here: binary, octal and hexadecimal formatting can easily avoid the temporary work buffer (the number of digits can be computed ahead-of-time using one of the __builtin_clz* built-ins). Decimal formatting can use a specialized version of _itoa_word for base 10. The existing (inconsistent) width handling between strfmon and printf is preserved here. __print_fp_buffer_1 would have to use __translated_number_width to achieve ISO conformance for printf. Test expectations in libio/tst-vtables-common.c are adjusted because the internal staging buffer merges all virtual function calls into one. In general, stack buffer usage is greatly reduced, particularly for unbuffered input streams. __printf_fp can still use a large buffer in binary128 mode for %g, though. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* stdlib: Move _IO_cleanup to call_function_static_weakAdhemerval Zanella2022-12-121-2/+0
| | | | Reviewed-by: Florian Weimer <fweimer@redhat.com>
* configure: Use -Wno-ignored-attributes if compiler warns about multiple aliasesAdhemerval Zanella2022-11-011-3/+11
| | | | | | | | | clang emits an warning when a double alias redirection is used, to warn the the original symbol will be used even when weak definition is overridden. However, this is a common pattern for weak_alias, where multiple alias are set to same symbol. Reviewed-by: Fangrui Song <maskray@google.com>
* Use PTR_MANGLE and PTR_DEMANGLE unconditionally in C sourcesFlorian Weimer2022-10-184-22/+0
| | | | | | | | | | | | | | | | | In the future, this will result in a compilation failure if the macros are unexpectedly undefined (due to header inclusion ordering or header inclusion missing altogether). Assembler sources are more difficult to convert. In many cases, they are hand-optimized for the mangling and no-mangling variants, which is why they are not converted. sysdeps/s390/s390-32/__longjmp.c and sysdeps/s390/s390-64/__longjmp.c are special: These are C sources, but most of the implementation is in assembler, so the PTR_DEMANGLE macro has to be undefined in some cases, to match the assembler style. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Introduce <pointer_guard.h>, extracted from <sysdep.h>Florian Weimer2022-10-184-1/+4
| | | | | | | | | | | | | | This allows us to define a generic no-op version of PTR_MANGLE and PTR_DEMANGLE. In the future, we can use PTR_MANGLE and PTR_DEMANGLE unconditionally in C sources, avoiding an unintended loss of hardening due to missing include files or unlucky header inclusion ordering. In i386 and x86_64, we can avoid a <tls.h> dependency in the C code by using the computed constant from <tcb-offsets.h>. <sysdep.h> no longer includes these definitions, so there is no cyclic dependency anymore when computing the <tcb-offsets.h> constants. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Use '%z' instead of '%Z' on printf functionsAdhemerval Zanella Netto2022-09-224-14/+14
| | | | | | | | The Z modifier is a nonstandard synonymn for z (that predates z itself) and compiler might issue an warning for in invalid conversion specifier. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Remove spurious references to _dl_open_hookFlorian Weimer2022-08-011-4/+0
| | | | | | | _dl_open_hook was removed in commit 466c1ea15f461edb8e3ffaf5d86d708 ("dlfcn: Rework static dlopen hooks"). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Apply asm redirections in stdio.h before first use [BZ #27087]Tulio Magno Quites Machado Filho2022-07-144-68/+124
| | | | | | | | | | | | | | | | | | | Compilers may not be able to apply asm redirections to functions after these functions are used for the first time, e.g. clang 13. Fix [BZ #27087] by applying all long double-related asm redirections before using functions in bits/stdio.h. However, as these asm redirections depend on the declarations provided by libio/bits/stdio2.h, this header was split in 2: - libio/bits/stdio2-decl.h contains all function declarations; - libio/bits/stdio2.h remains with the remaining contents, including redirections. This also adds the access attribute to __vsnprintf_chk that was missing. Tested with build-many-glibcs.py. Reviewed-by: Paul E. Murphy <murphyp@linux.ibm.com>