aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-01-19getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)siddhesh/realpath-and-getcwdSiddhesh Poyarekar
No valid path returned by getcwd would fit into 1 byte, so reject the size early and return NULL with errno set to ERANGE. This change is prompted by CVE-2021-3999, which describes a single byte buffer underflow and overflow when all of the following conditions are met: - The buffer size (i.e. the second argument of getcwd) is 1 byte - The current working directory is too long - '/' is also mounted on the current working directory Sequence of events: - In sysdeps/unix/sysv/linux/getcwd.c, the syscall returns ENAMETOOLONG because the linux kernel checks for name length before it checks buffer size - The code falls back to the generic getcwd in sysdeps/posix - In the generic func, the buf[0] is set to '\0' on line 250 - this while loop on line 262 is bypassed: while (!(thisdev == rootdev && thisino == rootino)) since the rootfs (/) is bind mounted onto the directory and the flow goes on to line 449, where it puts a '/' in the byte before the buffer. - Finally on line 458, it moves 2 bytes (the underflowed byte and the '\0') to the buf[0] and buf[1], resulting in a 1 byte buffer overflow. - buf is returned on line 469 and errno is not set. This resolves BZ #28769. Signed-off-by: Qualys Security Advisory <qsa@qualys.com> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-19realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]Siddhesh Poyarekar
realpath returns an allocated string when the result exceeds PATH_MAX, which is unexpected when its second argument is not NULL. This results in the second argument (resolved) being uninitialized and also results in a memory leak since the caller expects resolved to be the same as the returned value. Return NULL and set errno to ENAMETOOLONG if the result exceeds PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-19support: Add helpers to create paths longer than PATH_MAXSiddhesh Poyarekar
Add new helpers support_create_and_chdir_toolong_temp_directory and support_chdir_toolong_temp_directory to create and descend into directory trees longer than PATH_MAX. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-18elf: Move _dl_setup_hash to its own fileFlorian Weimer
And compile it with the early CFLAGS. _dl_setup_hash is called very early for the ld.so link map, so it should be compiled differently. Reviewed-by: Stefan Liebler <stli@linux.ibm.com> Tested-by: Stefan Liebler <stli@linux.ibm.com>
2022-01-17htl: Fix build error in annexcSamuel Thibault
We were getting ../scripts/evaluate-test.sh posix/annexc $? true false > /usr/src/glibc-upstream/build/posix/annexc.test-result In file included from ../include/pthread.h:1, from <stdin>:1: ../sysdeps/htl/include/pthread.h:7:62: error: missing binary operator before token "(" 7 | # if defined __USE_EXTERN_INLINES && defined _LIBC && !IS_IN (libsupport) | ^
2022-01-17elf: Reinstate tst-audit17Adhemerval Zanella
9926f6e2eeb3 ("elf: Skip tst-auditlogmod-* if the linker doesn't support --depaudit [BZ #28 151]") dropped the test by mistake.
2022-01-17x86: use default cache size if it cannot be determined [BZ #28784]Aurelien Jarno
In some cases (e.g QEMU, non-Intel/AMD CPU) the cache information can not be retrieved and the corresponding values are set to 0. Commit 2d651eb9265d ("x86: Move x86 processor cache info to cpu_features") changed the behaviour in such case by defining the __x86_shared_cache_size and __x86_data_cache_size variables to 0 instead of using the default values. This cause an issue with the i686 SSE2 optimized bzero/routine which assumes that the cache size is at least 128 bytes, and otherwise tries to zero/set the whole address space minus 128 bytes. Fix that by restoring the original code to only update __x86_shared_cache_size and __x86_data_cache_size variables if the corresponding cache sizes are not zero. Fixes bug 28784 Fixes commit 2d651eb9265d Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-17rt/tst-mqueue*: Return UNSUPPORTED when mq_open fails with ENOSYSSamuel Thibault
Rather than returning 0 or a failure.
2022-01-17Linux: Add epoll_pwait2 (BZ #27359)Adhemerval Zanella
It is similar to epoll_wait, with the difference the timeout has nanosecond resoluting by using struct timespec instead of int. Although Linux interface only provides 64 bit time_t support, old 32 bit interface is also provided (so keep in sync with current practice and to no force opt-in on 64 bit time_t). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer <fweimer@redhat.com>
2022-01-17Properly handle --disable-default-pie [BZ #28780]H.J. Lu
When --disable-default-pie is used, all glibc programs and the testsuite should be built as position dependent executables (non-PIE), regardless if the build compiler supports PIE or static PIE. When --disable-default-pie is used, don't build static PIE by default. This fixes BZ #28780. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-17elf: Fix 64 time_t support for installed statically binariesAdhemerval Zanella
The usage of internal static symbol for statically linked binaries does not work correctly for objects built with -D_TIME_BITS=64, since the internal definition does not provide the expected aliases. This patch makes it to use the default stat functions instead (which uses the default 64 time_t alias and types). Checked on i686-linux-gnu. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
2022-01-17Revert "elf: Fix 64 time_t support for installed statically binaries"Adhemerval Zanella
This reverts commit 0b8e83eb1455f3c0332eeb1f96fbc262fbd054e0.
2022-01-17CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)Florian Weimer
The sunrpc function svcunix_create suffers from a stack-based buffer overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-17sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)Martin Sebor
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-17CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)Florian Weimer
Processing an overlong pathname in the sunrpc clnt_create function results in a stack-based buffer overflow. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-17socket: Add the __sockaddr_un_set functionFlorian Weimer
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-17elf/tst-dl_find_object: Disable subtests for non-contiguous maps (bug 28732)Florian Weimer
Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-17elf: Set l_contiguous to 1 for the main map in more casesFlorian Weimer
l_contiguous was not initialized at all for the main map and always 0. This commit adds code to check if the LOAD segments are adjacent to each other, and sets l_contiguous accordingly. This helps _dl_find_object because it is more efficient if the main mapping is contiguous. Note that not all (PIE or non-PIE) binaries are contiguous in this way because BFD ld creates executables with LOAD holes: ELF LOAD segments creating holes in the process image on GNU/Linux https://sourceware.org/pipermail/binutils/2022-January/119082.html https://sourceware.org/bugzilla/show_bug.cgi?id=28743 Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-17elf: Introduce rtld_setup_main_mapFlorian Weimer
This function collects most of the processing needed to initialize the link map for the main executable. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-16hurd: Make RPC input array parameters constSamuel Thibault
This follows mig's cf4bcc3f1435 ("Also add const qualifiers on server side")
2022-01-16hurd: optimize exec cleanupSamuel Thibault
When ports are nul we do not need to request their deallocation. It is also useless to look for them in portnames.
2022-01-15hurd: Add __rtld_execveSamuel Thibault
It trivially execs with the same dtable, portarray and intarray, and only has to take care of deallocating / destroying ports (file, notably).
2022-01-15hurd: Fix exec() leak on proc_task2proc failureSamuel Thibault
env is allocated after args, so should be freed before it.
2022-01-15htl: Hide __pthread_attr's __schedparam type [BZ #23088]Samuel Thibault
The content of the structure is only used internally, so we can make __pthread_attr_getschedparam and __pthread_attr_setschedparam convert between the public sched_param type and an internal __sched_param. This allows to avoid to spuriously expose the sched_param type. This fixes BZ #23088.
2022-01-15htl: Clear kernel_thread field before releasing the thread structureSamuel Thibault
Otherwise this is a use-after-free.
2022-01-15hurd: drop SA_SIGINFO availability xfailSamuel Thibault
BZ #23089 was fixed by d865ff74ba09 ("hurd: implement SA_SIGINFO signal handlers")
2022-01-15hurd: Fix timer/clock_getres crash on NULL res parameterSamuel Thibault
POSIX allows res to be NULL.
2022-01-15hurd: Fix pthread_kill on exiting/ted threadSamuel Thibault
We have to drop the kernel_thread port from the thread structure, to avoid pthread_kill's call to _hurd_thread_sigstate trying to reference it and fail.
2022-01-15[hurd] Drop spurious #ifdef SHAREDSamuel Thibault
The whole file is already #ifdef SHARED
2022-01-15[hurd] Call _dl_sort_maps_init in _dl_sysdep_startSamuel Thibault
This follows 15a0c5730d1d ("elf: Fix slow DSO sorting behavior in dynamic loader (BZ #17645)").
2022-01-15elf tst-dl_find_object: Fix typoSamuel Thibault
mod1 was xdlclose()d a few lines above.
2022-01-14s390x: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer
This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
2022-01-14x86: Add x86-64-vN check to early startupFlorian Weimer
This ISA level covers the glibc build itself. <dl-hwcap-check.h> cannot be used because this check (by design) happens before DL_PLATFORM_INIT and the x86 CPU flags initialization. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-14powerpc64le: Use <gcc-macros.h> in early HWCAP checkFlorian Weimer
This is required so that the checks still work if $(early-cflags) selects a different ISA level. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
2022-01-14Add --with-rtld-early-cflags configure optionFlorian Weimer
Reviewed-by: H.J. Lu <hjl.tools@gmail.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2022-01-14elf: Split dl-printf.c from dl-misc.cFlorian Weimer
This allows to use different compiler flags for the diagnostics code. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-14elf/Makefile: Reflow and sort most variable assignmentsFlorian Weimer
Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-14Generate gcc-macros.hFlorian Weimer
The file can be used to check the effect of the default compiler flags on code generation even in areas of the build that uses non-default compiler flags. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-14x86: HAVE_X86_LAHF_SAHF, HAVE_X86_MOVBE and -march=x86-64-vN (bug 28782)Florian Weimer
HAVE_X86_LAHF_SAHF is implied by x86-64-v2, and HAVE_X86_MOVBE by x86-64-v3. The individual flag does not appear in -fverbose-asm flag output even if the ISA level implies it. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-14math: Add more inputs to atan2 accuracy tests [BZ #28765]Sunil K Pandey
This patch adds following inputs: 0x1.bcab29da0e947p-54 0x1.bc41f4d2294b8p-54 0x1.a11891ec004d4p-348 0x1.814830510be26p-348 0x1.b836ed678be29p-588 0x1.b7be6f5a03a8cp-588 0x1.a83f842ef3f73p-633 0x1.a799d8a6677ep-633 to atan2 tests and updates x86_64 double atan2 ulps. This fixes BZ #28765. Reviewed-By: Paul Zimmermann <Paul.Zimmermann@inria.fr>
2022-01-14Disable debuginfod in printer tests [BZ #28757]H.J. Lu
With gdb-11.1-6.fc35.x86_64, I got FAIL: nptl/test-cond-printers FAIL: nptl/test-condattr-printers FAIL: nptl/test-mutex-printers FAIL: nptl/test-mutexattr-printers FAIL: nptl/test-rwlock-printers FAIL: nptl/test-rwlockattr-printers $ cat nptl/test-condattr-printers.out Error: Response does not match the expected pattern. Command: start Expected pattern: main Response: Temporary breakpoint 1 at 0x11d5: file test-condattr-printers.c, line 43. Starting program: /export/build/gnu/tools-build/glibc-cet-gitlab/build-x86_64-linux/nptl/test-condattr-printers This GDB supports auto-downloading debuginfo from the following URLs: https://debuginfod.fedoraproject.org/ Enable debuginfod for this session? (y or [n]) Disable debuginfod to avoid GDB messages. This fixes BZ #28757. Reviewed-by: Florian Weimer <fweimer@redhat.com>
2022-01-13Update syscall lists for Linux 5.16Joseph Myers
Linux 5.16 has one new syscall, futex_waitv. Update syscall-names.list and regenerate the arch-syscall.h headers with build-many-glibcs.py update-syscalls. Tested with build-many-glibcs.py.
2022-01-13i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bug 28771)Florian Weimer
The configure check for CAN_USE_REGISTER_ASM_EBP tried to compile a simple function that uses %ebp as an inline assembly operand. If compilation failed, CAN_USE_REGISTER_ASM_EBP was set 0, which eventually had these consequences: (1) %ebx was avoided as an inline assembly operand, with an assembler macro hack to avoid unnecessary register moves. (2) %ebp was avoided as an inline assembly operand, using an out-of-line syscall function for 6-argument system calls. (1) is no longer needed for any GCC version that is supported for building glibc. %ebx can be used directly as a register operand. Therefore, this commit removes the %ebx avoidance completely. This avoids the assembler macro hack, which turns out to be incompatible with the current Systemtap probe macros (which switch to .altmacro unconditionally). (2) is still needed in many build configurations. The existing configure check cannot really capture that because the simple function succeeds to compile, while the full glibc build still fails. Therefore, this commit removes the check, the CAN_USE_REGISTER_ASM_EBP macro, and uses the out-of-line syscall function for 6-argument system calls unconditionally. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-13stdlib: Fix formatting of tests list in MakefileSiddhesh Poyarekar
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Florian Weimer <fweimer@redhat.com>
2022-01-13stdlib: Sort tests in MakefileSiddhesh Poyarekar
Put one test per line and sort them. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
2022-01-12x86_64: Fix SSE4.2 libmvec atan2 function accuracy [BZ #28765]Sunil K Pandey
This patch fixes SSE4.2 libmvec atan2 function accuracy for following inputs to less than 4 ulps. {0x1.bcab29da0e947p-54,0x1.bc41f4d2294b8p-54} 4.19888 ulps {0x1.b836ed678be29p-588,0x1.b7be6f5a03a8cp-588} 4.09889 ulps This fixes BZ #28765. Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2022-01-12debug: Synchronize feature guards in fortified functions [BZ #28746]Siddhesh Poyarekar
Some functions (e.g. stpcpy, pread64, etc.) had moved to POSIX in the main headers as they got incorporated into the standard, but their fortified variants remained under __USE_GNU. As a result, these functions did not get fortified when _GNU_SOURCE was not defined. Add test wrappers that check all functions tested in tst-chk0 at all levels with _GNU_SOURCE undefined and then use the failures to (1) exclude checks for _GNU_SOURCE functions in these tests and (2) Fix feature macro guards in the fortified function headers so that they're the same as the ones in the main headers. This fixes BZ #28746. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2022-01-12debug: Autogenerate _FORTIFY_SOURCE testsSiddhesh Poyarekar
Rename debug/tst-chk1.c to debug/tst-fortify.c and add make hackery to autogenerate tests with different macros enabled to build and run the same test with different configurations as well as different fortification levels. The change also ends up expanding the -lfs tests to include _FORTIFY_SOURCE=3. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2022-01-12Do not build libresolv module with 64 bit time_t flagsAdhemerval Zanella
It is not used to build installed programs. It also fixes resolv/tst-p_secstodate on big endian machines. Checked on i686-linux-gnu and powerpc-linux-gnu-power4.
2022-01-12Revert "linux: Fix ancillary 64-bit time timestamp conversion (BZ #28349, BZ ↵Adhemerval Zanella
#28350)" This reverts commit 21e0f45c7d73df6fe30c77ffcc9f81410e2ee369.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-12 18:09:20 +0000