about summary refs log tree commit diff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* add issetugid function to check for elevated privilegeBrent Cook2014-07-191-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this function provides a way for third-party library code to use the same logic that's used internally in libc for suppressing untrusted input/state (e.g. the environment) when the application is running with privleges elevated by the setuid or setgid bit or some other mechanism. its semantics are intended to match the openbsd function by the same name. there was some question as to whether this function is necessary: getauxval(AT_SECURE) was proposed as an alternative. however, this has several drawbacks. the most obvious is that it asks programmers to be aware of an implementation detail of ELF-based systems (the aux vector) rather than simply the semantic predicate to be checked. and trying to write a safe, reliable version of issetugid in terms of getauxval is difficult. for example, early versions of the glibc getauxval did not report ENOENT, which could lead to false negatives if AT_SECURE was not present in the aux vector (this could probably only happen when running on non-linux kernels under linux emulation, since glibc does not support linux versions old enough to lack AT_SECURE). as for musl, getauxval has always properly reported errors, but prior to commit 7bece9c2095ee81f14b1088f6b0ba2f37fecb283, the musl implementation did not emulate AT_SECURE if missing, which would result in a false positive. since musl actually does partially support kernels that lack AT_SECURE, this was problematic. the intent is that library authors will use issetugid if its availability is detected at build time, and only fall back to the unreliable alternatives on systems that lack it. patch by Brent Cook. commit message/rationale by Rich Felker.
* fix missing flags arg to fstatat syscall in fstat fallback pathRich Felker2014-07-181-1/+1
| | | | | | | | | | | | this code path is used only on archs without the plain, non-at syscalls, and only when the fstat syscall fails with EBADF on a valid file descriptor. this in turn can happen only for O_PATH file descriptors, and may not happen at all on the newer kernels needed for supporting such archs. with the flags argument omitted, spurious fstat failures may happen when the argument register happens to have the AT_SYMLINK_NOFOLLOW bit set.
* add or1k (OpenRISC 1000) architecture portStefan Kristiansson2014-07-1810-0/+187
| | | | | | | | | | | | | | | With the exception of a fenv implementation, the port is fully featured. The port has been tested in or1ksim, the golden reference functional simulator for OpenRISC 1000. It passes all libc-test tests (except the math tests that requires a fenv implementation). The port assumes an or1k implementation that has support for atomic instructions (l.lwa/l.swa). Although it passes all the libc-test tests, the port is still in an experimental state, and has yet experienced very little 'real-world' use.
* provide getauxval(AT_SECURE) even if it is missing from the aux vectorRich Felker2014-07-171-0/+1
| | | | | | | | | | | | | this could happen on 2.4-series linux kernels that predate AT_SECURE and possibly on other kernels that are emulating the linux syscall API but not providing AT_SECURE in the aux vector at startup. in principle applications should be checking errno anyway, but this does not really work. to be secure, the caller would have to treat ENOENT (indeterminate result) as possibly-suid and thereby disable functionality in the typical non-suid usage case. and since glibc only runs on kernels that provide AT_SECURE, applications written to the glibc getauxval API might simply assume it succeeds.
* remove useless infinite loop from end of exit functionRich Felker2014-07-171-1/+0
| | | | | | | | this was originally added as a cheap but portable way to quell warnings about reaching the end of a function that does not return, but since _Exit is marked _Noreturn, it's not needed. removing it makes the call to _Exit into a tail call and shaves off a few bytes of code from minimal static programs.
* fix crash in regexec for nonzero nmatch argument with REG_NOSUBRich Felker2014-07-171-0/+1
| | | | | per POSIX, the nmatch and pmatch arguments are ignored when the regex was compiled with REG_NOSUB.
* work around constant folding bug 61144 in gcc 4.9.0 and 4.9.1Rich Felker2014-07-167-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | previously we detected this bug in configure and issued advice for a workaround, but this turned out not to work. since then gcc 4.9.0 has appeared in several distributions, and now 4.9.1 has been released without a fix despite this being a wrong code generation bug which is supposed to be a release-blocker, per gcc policy. since the scope of the bug seems to affect only data objects (rather than functions) whose definitions are overridable, and there are only a very small number of these in musl, I am just changing them from const to volatile for the time being. simply removing the const would be sufficient to make gcc 4.9.1 work (the non-const case was inadvertently fixed as part of another change in gcc), and this would also be sufficient with 4.9.0 if we forced -O0 on the affected files or on the whole build. however it's cleaner to just remove all the broken compiler detection and use volatile, which will ensure that they are never constant-folded. the quality of a non-broken compiler's output should not be affected except for the fact that these objects are no longer const and thus possibly add a few bytes to data/bss. this change can be reconsidered and possibly reverted at some point in the future when the broken gcc versions are no longer relevant.
* simplify __stdio_exit static linking logicRich Felker2014-07-164-16/+12
| | | | | | | | | | | | | | | | | | | the purpose of this logic is to avoid linking __stdio_exit unless any stdio reads (which might require repositioning the file offset at exit time) or writes (which might require flushing at exit time) could have been performed. previously, exit called two wrapper functions for __stdio_exit named __flush_on_exit and __seek_on_exit. both of these functions actually performed both tasks (seek and flushing) by calling the underlying __stdio_exit. in order to avoid doing this twice, an overridable data object __towrite_used was used to cause __seek_on_exit to act as a nop when __towrite was linked. now, exit only makes one call, directly to __stdio_exit. this is satisfiable by a weak dummy definition in exit.c, but the real definition is pulled in by either __toread.c or __towrite.c through their referencing a symbol which is defined only in __stdio_exit.c.
* implement the LOG_CONS option in syslogRich Felker2014-07-111-1/+9
| | | | | | | this was previously a no-op, somewhat intentionally, because I failed to understand that it only has an effect when sending to the logging facility fails and thus is not the nuisance that it would be if always sent output to the console.
* suppress early syslog return when log socket cannot be openedRich Felker2014-07-111-4/+1
| | | | | | | this behavior is no longer valid in general, and was never necessary. if the LOG_PERROR option is set, output to stderr could still succeed. also, when the LOG_CONS option is added, it will need syslog to proceed even if opening the log socket fails.
* implement the LOG_PERROR option in syslogRich Felker2014-07-111-2/+4
| | | | | | | | | | | | | | this is a nonstandard feature, but easy and inexpensive to add. since the corresponding macro has always been defined in our syslog.h, it makes sense to actually support it. applications may reasonably be using the presence of the macro to assume that the feature is supported. the behavior of omitting the 'header' part of the log message does not seem to be well-documented, but matches other implementations (at least glibc) which have this option. based on a patch by Clément Vasseur, but simplified using %n.
* fix the %m specifier in syslogClément Vasseur2014-07-111-0/+3
| | | | | | errno must be saved upon vsyslog entry, otherwise its value could be changed by some libc function before reaching the %m handler in vsnprintf.
* explicitly reject empty names in dynamic linker load_library functionRich Felker2014-07-111-0/+5
| | | | | | | | | previously passing an empty string for name resulted in failure, as expected, but only after spurious syscalls, and it produced confusing errno values (and thus dlerror strings). in addition to dlopen calls, this issue affected use of LD_PRELOAD with trailing whitespace or colon characters.
* make dynamic linker accept colon as a separator for LD_PRELOADRich Felker2014-07-111-2/+2
|
* fix typo in microblaze setjmp asmRich Felker2014-07-081-1/+1
| | | | | | | | r24 was wrongly being saved at a misaligned offset of 30 rather than the correct offset of 40 in the jmp_buf. the exact effects of this error have not been studied, but it's clear that the value of r24 was lost across setjmp/longjmp and the saved values of r21 and/or r22 may also have been corrupted.
* rename file containing pthread_cleanup_push and pop for consistencyRich Felker2014-07-061-0/+0
|
* rework cancellation weak alias logic not to depend on archive orderRich Felker2014-07-063-6/+12
| | | | | | | | | | | if the order of object files in the static archive libc.a was not respected by the linker, the old logic could wrongly cause POSIX symbols outside of the ISO C namespace to be pulled into pure C programs. this should not happen with well-behaved linkers, but relying on the link order was a bad idea anyway. files are renamed to better reflect their contents now that they don't need names to control their order as members in the archive file.
* fix multiple issues in legacy function getpassRich Felker2014-07-061-5/+6
| | | | | | | | | | 1. failure to output a newline after the password is read 2. fd leaks via missing FD_CLOEXEC 3. fd leaks via failure-to-close when any of the standard streams are closed at the time of the call 4. wrongful fallback to use of stdin when opening /dev/tty fails 5. wrongful use of stderr rather than /dev/tty for prompt 6. failure to report error reading password
* eliminate use of cached pid from thread structureRich Felker2014-07-058-12/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | the main motivation for this change is to remove the assumption that the tid of the main thread is also the pid of the process. (the value returned by the set_tid_address syscall was used to fill both fields despite it semantically being the tid.) this is historically and presently true on linux and unlikely to change, but it conceivably could be false on other systems that otherwise reproduce the linux syscall api/abi. only a few parts of the code were actually still using the cached pid. in a couple places (aio and synccall) it was a minor optimization to avoid a syscall. caching could be reintroduced, but lazily as part of the public getpid function rather than at program startup, if it's deemed important for performance later. in other places (cancellation and pthread_kill) the pid was completely unnecessary; the tkill syscall can be used instead of tgkill. this is actually a rather subtle issue, since tgkill is supposedly a solution to race conditions that can affect use of tkill. however, as documented in the commit message for commit 7779dbd2663269b465951189b4f43e70839bc073, tgkill does not actually solve this race; it just limits it to happening within one process rather than between processes. we use a lock that avoids the race in pthread_kill, and the use in the cancellation signal handler is self-targeted and thus not subject to tid reuse races, so both are safe regardless of which syscall (tgkill or tkill) is used.
* properly pass current locale to *_l functions when used internallyRich Felker2014-07-028-8/+16
| | | | | this change is presently non-functional since the callees do not yet use their locale argument for anything.
* consolidate str[n]casecmp_l into str[n]casecmp source filesRich Felker2014-07-024-13/+16
| | | | | this is mainly done for consistency with the ctype functions and to declutter the src/locale directory.
* consolidate *_l ctype/wctype functions into their non-_l source filesRich Felker2014-07-0261-213/+256
| | | | | | | | | | | | | the main practical purposes of this commit are to remove a huge amount of clutter from the src/locale directory, to cut down on the length of the $(AR) and $(LD) command lines, and to reduce the amount of space wasted by object file headers in the static libc.a. build time may also be reduced, though this has not been measured. as an additional justification, if there ever were a need for the behavior of these functions to vary by locale, it would be necessary for the non-_l versions to call the _l versions, so that linking the former without the latter would not be possible anyway.
* add locale frameworkRich Felker2014-07-029-22/+186
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | this commit adds non-stub implementations of setlocale, duplocale, newlocale, and uselocale, along with the data structures and minimal code needed for representing the active locale on a per-thread basis and optimizing the common case where thread-local locale settings are not in use. at this point, the data structures only contain what is necessary to represent LC_CTYPE (a single flag) and LC_MESSAGES (a name for use in finding message translation files). representation for the other categories will be added later; the expectation is that a single pointer will suffice for each. for LC_CTYPE, the strings "C" and "POSIX" are treated as special; any other string is accepted and treated as "C.UTF-8". for other categories, any string is accepted after being truncated to a maximum supported length (currently 15 bytes). for LC_MESSAGES, the name is kept regardless of whether libc itself can use such a message translation locale, since applications using catgets or gettext should be able to use message locales libc is not aware of. for other categories, names which are not successfully loaded as locales (which, at present, means all names) are treated as aliases for "C". setlocale never fails. locale settings are not yet used anywhere, so this commit should have no visible effects except for the contents of the string returned by setlocale.
* fix failure of wide printf/scanf functions to set wide orientationRich Felker2014-07-022-0/+3
| | | | | | in some cases, these functions internally call a byte-based input or output function before calling getwc/putwc, so they cannot rely on the latter to set the orientation.
* fix typo in a comment in __libc_start_mainRich Felker2014-07-011-1/+1
|
* fix incorrect return value for fwide functionRich Felker2014-07-011-1/+2
| | | | | | when the orientation of the stream was already set, fwide was incorrectly returning its argument (the requested orientation) rather than the actual orientation of the stream.
* fix ungrammatical comment in posix_spawn codeRich Felker2014-07-011-3/+3
|
* fix aliasing violations in mbtowc and mbrtowcRich Felker2014-07-012-2/+4
| | | | | | | | | | these functions were setting wc to point to wchar_t aliasing itself as a "cheap" way to support null wc arguments. doing so was anything but cheap, since even without the aliasing violation, it would limit the compiler's ability to optimize. making wc point to a dummy object is equally easy and does not suffer from the above problems.
* fix regression in mips dynamic linkerRich Felker2014-06-301-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this issue caused the address of functions in shared libraries to resolve to their PLT thunks in the main program rather than their correct addresses. it was observed causing crashes, though the mechanism of the crash was not thoroughly investigated. since the issue is very subtle, it calls for some explanation: on all well-behaved archs, GOT entries that belong to the PLT use a special relocation type, typically called JMP_SLOT, so that the dynamic linker can avoid having the jump destinations for the PLT resolve to PLT thunks themselves (they also provide a definition for the symbol, which must be used whenever the address of the function is taken so that all DSOs see the same address). however, the traditional mips PIC ABI lacked such a JMP_SLOT relocation type, presumably because, due to the way PIC works, the address of the PLT thunk was never needed and could always be ignored. prior to commit adf94c19666e687a728bbf398f9a88ea4ea19996, the mips version of reloc.h contained a hack that caused all symbol lookups to be treated like JMP_SLOT, inhibiting undefined symbols from ever being used to resolve symbolic relocations. this hack goes all the way back to commit babf820180368f00742ec65b2050a82380d7c542, when the mips dynamic linker was first made usable. during the recent refactoring to eliminate arch-specific relocation processing (commit adf94c19666e687a728bbf398f9a88ea4ea19996), this hack was overlooked and no equivalent functionality was provided in the new code. fixing the problem is not as simple as adding back an equivalent hack, since there is now also a "non-PIC ABI" that can be used for the main executable, which actually does use a PLT. the closest thing to official documentation I could find for this ABI is nonpic.txt, attached to Message-ID: 20080701202236.GA1534@caradoc.them.org, which can be found in the gcc mailing list archives and elsewhere. per this document, undefined symbols corresponding to PLT thunks have the STO_MIPS_PLT bit set in the symbol's st_other field. thus, I have added an arch-specific rule for mips, applied at the find_sym level rather than the relocation level, to reject undefined symbols with the STO_MIPS_PLT bit clear. the previous hack of treating all mips relocations as JMP_SLOT-like, rather than rejecting the unwanted symbols in find_sym, probably also caused dlsym to wrongly return PLT thunks in place of the correct address of a function under at least some conditions. this should now be fixed, at least for global-scope symbol lookups.
* fix regression in dynamic linker error reportingRich Felker2014-06-291-9/+5
| | | | | | due to a mistake when refactoring the error printing for the dynamic linker (commit 7c73cacd09a51a87484db5689864743e4984a84d), all messages were suppressed and replaced by blank lines.
* add routing protocols to getprotoent-family functionsTimo Teräs2014-06-241-0/+2
| | | | iptables and quagga need them to work.
* rename dynamic linker _start to _dlstart in the stub versionRich Felker2014-06-231-1/+1
| | | | | the renaming was previously applied to all real versions of the function in commit 3fa2eb2aba8d6b54dec53e7ad4c37e17392b166f.
* add __sysv_signal abi-compat alias for the signal functionRich Felker2014-06-221-0/+1
| | | | | | | | | | it should be noted that the "real" __sysv_signal, which we do not implement, is semantically different from signal. references to __sysv_signal arise in code built against glibc under certain combinations of feature test macros, and are almost surely unintentional since the legacy sysv signal behavior has fundamental race conditions that cannot be worked around and which make it impossible to use safely.
* add __xmknod and __xmknodat abi-compat functionsRich Felker2014-06-221-0/+10
| | | | | these are put alongside the similar functions for __xstat, etc. in __xstat.c to avoid bloating the number of source files.
* consolidate __xstat abi-compat functions into a single source fileRich Felker2014-06-224-27/+18
| | | | | | | | | | these are mostly intended for use with dynamic linking (although they can also be used statically with object files compiled against glibc headers), so having them broken down into separate source files to optimize for static linking is unlikely to be worth the cost having more files in the source tree (which contributes to libc.a overhead, compile time, link time, ar/linker command line size exhaustion, and so on).
* implement fmtmsg functionRich Felker2014-06-211-0/+90
| | | | | contributed by Isaac Dunham. this seems to be the last interface that was missing for complete POSIX 2008 base + XSI coverage.
* implement result address sorting in the resolver (getaddrinfo, etc.)Rich Felker2014-06-212-0/+136
|
* fix gethostby*_r result pointer value on errorTimo Teräs2014-06-202-0/+3
| | | | | | | according to the documentation in the man pages, the GNU extension functions gethostbyaddr_r, gethostbyname_r and gethostbyname2_r are guaranteed to set the result pointer to NULL in case of error or no result.
* fix sendmmsg emulation return value for zero-length vectorRich Felker2014-06-201-0/+1
| | | | | this case is not even documented, but the kernel returns 0 here and it makes sense to be consistent.
* rename dynamic linker entry point from _start to _dlstartRich Felker2014-06-208-19/+19
| | | | | | the main motivation for this change is to aid in debugging. since the main program's entry point is also named _start, it was difficult to set breakpoints or quickly identify which _start execution stopped in.
* implement sendmmsg and recvmmsgRich Felker2014-06-192-0/+44
| | | | | | | these are not pure syscall wrappers because they have to work around kernel API bugs on 64-bit archs. the workarounds could probably be made somewhat more efficient, but at the cost of more complexity. this may be revisited later.
* add tlsdesc support for x86_64Rich Felker2014-06-191-0/+40
|
* separate __tls_get_addr implementation from dynamic linker/init_tlsRich Felker2014-06-193-11/+23
| | | | | | | | | | | | | | | such separation serves multiple purposes: - by having the common path for __tls_get_addr alone in its own function with a tail call to the slow case, code generation is greatly improved. - by having __tls_get_addr in it own file, it can be replaced on a per-arch basis as needed, for optimization or ABI-specific purposes. - by removing __tls_get_addr from __init_tls.c, a few bytes of code are shaved off of static binaries (which are unlikely to use this function unless the linker messed up).
* add tlsdesc support for i386Rich Felker2014-06-191-0/+27
|
* optimize i386 ___tls_get_addr asmRich Felker2014-06-191-1/+8
|
* change dynamic TLS installation strategy to optimize accessRich Felker2014-06-191-8/+14
| | | | | | | | | | | | | | | previously, accesses to dynamic TLS had to check two conditions before being able to use a dtv slot: (1) that the module index was within the bounds of the current dtv size, and (2) that the dynamic tls for the requested module index was already installed in the dtv. this commit changes the installation strategy so that, whenever an attempt is made to access dynamic TLS that's not yet installed in the dtv, the dynamic TLS for all lower-index modules is also installed. thus it provides a new invariant: if a given module index is within the bounds of the current dtv size, we automatically know that its TLS is installed and directly available. the requirement that the second condition (above) be checked is eliminated.
* add arch-generic support for tlsdesc relocations to dynamic linkerRich Felker2014-06-192-0/+54
| | | | | | this code is non-functional without further changes to link up the arch-specific reloc types for tlsdesc and add asm implementations of __tlsdesc_static and __tlsdesc_dynamic.
* fix incorrect comparison loop condition in memmemRich Felker2014-06-191-2/+2
| | | | | | | | | | the logic for this loop was copied from null-terminated-string logic in strstr without properly adapting it to work with explicit lengths. presumably this error could result in false negatives (wrongly comparing past the end of the needle/haystack), false positives (stopping comparison early when the needle contains null bytes), and crashes (from runaway reads past the end of mapped memory).
* reduce code duplication in dynamic linker error pathsRich Felker2014-06-181-16/+16
| | | | eventually this should help making dlerror thread-safe too.
* refactor to remove arch-specific relocation code from dynamic linkerRich Felker2014-06-181-8/+89
| | | | | | | | | | | this was one of the main instances of ugly code duplication: all archs use basically the same types of relocations, but roughly equivalent logic was duplicated for each arch to account for the different naming and numbering of relocation types and variation in whether REL or RELA records are used. as an added bonus, both REL and RELA are now supported on all archs, regardless of which is used by the standard toolchain.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-01 06:54:30 +0000