aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-12-13powerpc: Add missing CFI register information (bug #23614)Tulio Magno Quites Machado Filho
Add CFI information about the offset of registers stored in the stack frame. [BZ #23614] * sysdeps/powerpc/powerpc64/addmul_1.S (FUNC): Add CFI offset for registers saved in the stack frame. * sysdeps/powerpc/powerpc64/lshift.S (__mpn_lshift): Likewise. * sysdeps/powerpc/powerpc64/mul_1.S (__mpn_mul_1): Likewise. Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> Reviewed-by: Gabriel F. T. Gomes <gabriel@inconstante.eti.br> (cherry picked from commit 1d880d4a9bf7608c2cd33bbe954ce6995f79121a)
2018-12-12malloc: Add another test for tcache double free check.DJ Delorie
This one tests for BZ#23907 where the double free test didn't check the tcache bin bounds before dereferencing the bin. [BZ #23907] * malloc/tst-tcfree3.c: New. * malloc/Makefile: Add it. (cherry picked from commit 7c9a7c68363051cfc5fa1ebb96b3b2c1f82dcb76)
2018-12-12inet/tst-if_index-long: New test case for CVE-2018-19591 [BZ #23927]Florian Weimer
(cherry picked from commit 899478c2bfa00c5df8d8bedb52effbb065700278)
2018-12-12support: Implement <support/descriptors.h> to track file descriptorsFlorian Weimer
(cherry picked from commit f255336a9301619519045548acb2e1027065a837)
2018-12-12support: Close original descriptors in support_capture_subprocessFlorian Weimer
(cherry picked from commit 02cd5c1a8d033d7f91fea12a66bb44d1bbf85f76)
2018-12-12support_quote_string: Do not use str parameter nameFlorian Weimer
This avoids a build failure if this identifier is used as a macro in a test. (cherry picked from commit 47d8d9a2172f827a8dde7695f415aa6f78a82d0e)
2018-12-12support: Implement support_quote_stringFlorian Weimer
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com> (cherry picked from commit c74a91deaa5de416237c02bbb3e41bda76ca4c7b)
2018-12-10compat getdents64: Use correct offset for retry [BZ #23972]Florian Weimer
d_off is the offset of the *next* entry, not the offset of the current entry. (cherry picked from commit 8d20a2f414fa52aceef8a0e3675415df54a840db)
2018-12-07Fix _dl_profile_fixup data-dependency issue (Bug 23690)Tulio Magno Quites Machado Filho
There is a data-dependency between the fields of struct l_reloc_result and the field used as the initialization guard. Users of the guard expect writes to the structure to be observable when they also observe the guard initialized. The solution for this problem is to use an acquire and release load and store to ensure previous writes to the structure are observable if the guard is initialized. The previous implementation used DL_FIXUP_VALUE_ADDR (l_reloc_result->addr) as the initialization guard, making it impossible for some architectures to load and store it atomically, i.e. hppa and ia64, due to its larger size. This commit adds an unsigned int to l_reloc_result to be used as the new initialization guard of the struct, making it possible to load and store it atomically in all architectures. The fix ensures that the values observed in l_reloc_result are consistent and do not lead to crashes. The algorithm is documented in the code in elf/dl-runtime.c (_dl_profile_fixup). Not all data races have been eliminated. Tested with build-many-glibcs and on powerpc, powerpc64, and powerpc64le. [BZ #23690] * elf/dl-runtime.c (_dl_profile_fixup): Guarantee memory modification order when accessing reloc_result->addr. * include/link.h (reloc_result): Add field init. * nptl/Makefile (tests): Add tst-audit-threads. (modules-names): Add tst-audit-threads-mod1 and tst-audit-threads-mod2. Add rules to build tst-audit-threads. * nptl/tst-audit-threads-mod1.c: New file. * nptl/tst-audit-threads-mod2.c: Likewise. * nptl/tst-audit-threads.c: Likewise. * nptl/tst-audit-threads.h: Likewise. Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit e5d262effe3a87164308a3f37e61b32d0348692a)
2018-11-28malloc: tcache double free checkDJ Delorie
* malloc/malloc.c (tcache_entry): Add key field. (tcache_put): Set it. (tcache_get): Likewise. (_int_free): Check for double free in tcache. * malloc/tst-tcfree1.c: New. * malloc/tst-tcfree2.c: New. * malloc/Makefile: Run the new tests. * manual/probes.texi: Document memory_tcache_double_free probe. * dlfcn/dlerror.c (check_free): Prevent double frees. (cherry picked from commit bcdaad21d4635931d1bd3b54a7894276925d081d) malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907] The previous check could read beyond the end of the tcache entry array. If the e->key == tcache cookie check happened to pass, this would result in crashes. (cherry picked from commit affec03b713c82c43a5b025dddc21bde3334f41e)
2018-11-27CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]Florian Weimer
(cherry picked from commit d527c860f5a3f0ed687bd03f0cb464612dc23408)
2018-11-22Revert "malloc: tcache double free check" [BZ #23907]Florian Weimer
This reverts commit 481a6cf0c24f02f251d7cd0b776c12d00e6b144f, the backport of commit bcdaad21d4635931d1bd3b54a7894276925d081d on the master branch.
2018-11-20malloc: tcache double free checkDJ Delorie
* malloc/malloc.c (tcache_entry): Add key field. (tcache_put): Set it. (tcache_get): Likewise. (_int_free): Check for double free in tcache. * malloc/tst-tcfree1.c: New. * malloc/tst-tcfree2.c: New. * malloc/Makefile: Run the new tests. * manual/probes.texi: Document memory_tcache_double_free probe. * dlfcn/dlerror.c (check_free): Prevent double frees.
2018-11-19support: Print timestamps in timeout handlerFlorian Weimer
This is sometimes useful to determine if a test truly got stuck, or if it was making progress (logging information to standard output) and was merely slow to finish. (cherry picked from commit 35e3fbc4512c880fccb35b8e3abd132d4be18480)
2018-11-19Increase timeout of libio/tst-readlineSzabolcs Nagy
Increase timeout from the default 20s to 100s. This test makes close to 20 million syscalls with distribution: 12327675 read 4143204 lseek 929475 close 929471 openat 92817 fstat 1431 write ... The default timeout assumes each can finish in 1us on average which is not true on slow machines. Reviewed-by: Carlos O'Donell <carlos@redhat.com> * libio/tst-readline.c (TIMEOUT): Define. (cherry picked from commit ed643089cd3251038863d32e67ec47b94cd557f3)
2018-11-09Update kernel version in syscall-names.list to 4.19.Joseph Myers
Linux 4.19 does not add any new syscalls (some existing ones are added to more architectures); this patch updates the version number in syscall-names.list to reflect that it's still current for 4.19. Tested with build-many-glibcs.py. * sysdeps/unix/sysv/linux/syscall-names.list: Update kernel version to 4.19. (cherry picked from commit 029ad711b8ad4cf0e5d98e0c138a35a23a376a74)
2018-11-09Fix tzfile low-memory assertion failurePaul Eggert
[BZ #21716] * time/tzfile.c (__tzfile_read): Check for memory exhaustion when registering time zone abbreviations. (cherry picked from commit e4e4fde51a309801af5eed72d3494cbf4b7737aa)
2018-11-09[BZ #20271] Add newlines in __libc_fatal calls.Paul Pluzhnikov
(cherry picked from commit a6e8926f8d49a213a9abb1a61f6af964f612ab7f)
2018-11-09nscd: Fix use-after-free in addgetnetgrentX [BZ #23520]Florian Weimer
addinnetgrX may use the heap-allocated buffer, so free the buffer in this function. (cherry picked from commit 745664bd798ec8fd50438605948eea594179fba1)
2018-11-09malloc: Additional checks for unsorted bin integrity I.Istvan Kurucsai
On Thu, Jan 11, 2018 at 3:50 PM, Florian Weimer <fweimer@redhat.com> wrote: > On 11/07/2017 04:27 PM, Istvan Kurucsai wrote: >> >> + next = chunk_at_offset (victim, size); > > > For new code, we prefer declarations with initializers. Noted. >> + if (__glibc_unlikely (chunksize_nomask (victim) <= 2 * SIZE_SZ) >> + || __glibc_unlikely (chunksize_nomask (victim) > >> av->system_mem)) >> + malloc_printerr("malloc(): invalid size (unsorted)"); >> + if (__glibc_unlikely (chunksize_nomask (next) < 2 * SIZE_SZ) >> + || __glibc_unlikely (chunksize_nomask (next) > >> av->system_mem)) >> + malloc_printerr("malloc(): invalid next size (unsorted)"); >> + if (__glibc_unlikely ((prev_size (next) & ~(SIZE_BITS)) != >> size)) >> + malloc_printerr("malloc(): mismatching next->prev_size >> (unsorted)"); > > > I think this check is redundant because prev_size (next) and chunksize > (victim) are loaded from the same memory location. I'm fairly certain that it compares mchunk_size of victim against mchunk_prev_size of the next chunk, i.e. the size of victim in its header and footer. >> + if (__glibc_unlikely (bck->fd != victim) >> + || __glibc_unlikely (victim->fd != unsorted_chunks (av))) >> + malloc_printerr("malloc(): unsorted double linked list >> corrupted"); >> + if (__glibc_unlikely (prev_inuse(next))) >> + malloc_printerr("malloc(): invalid next->prev_inuse >> (unsorted)"); > > > There's a missing space after malloc_printerr. Noted. > Why do you keep using chunksize_nomask? We never investigated why the > original code uses it. It may have been an accident. You are right, I don't think it makes a difference in these checks. So the size local can be reused for the checks against victim. For next, leaving it as such avoids the masking operation. > Again, for non-main arenas, the checks against av->system_mem could be made > tighter (against the heap size). Maybe you could put the condition into a > separate inline function? We could also do a chunk boundary check similar to what I proposed in the thread for the first patch in the series to be even more strict. I'll gladly try to implement either but believe that refining these checks would bring less benefits than in the case of the top chunk. Intra-arena or intra-heap overlaps would still be doable here with unsorted chunks and I don't see any way to counter that besides more generic measures like randomizing allocations and your metadata encoding patches. I've attached a revised version with the above comments incorporated but without the refined checks. Thanks, Istvan From a12d5d40fd7aed5fa10fc444dcb819947b72b315 Mon Sep 17 00:00:00 2001 From: Istvan Kurucsai <pistukem@gmail.com> Date: Tue, 16 Jan 2018 14:48:16 +0100 Subject: [PATCH v2 1/1] malloc: Additional checks for unsorted bin integrity I. Ensure the following properties of chunks encountered during binning: - victim chunk has reasonable size - next chunk has reasonable size - next->prev_size == victim->size - valid double linked list - PREV_INUSE of next chunk is unset * malloc/malloc.c (_int_malloc): Additional binning code checks. (cherry picked from commit b90ddd08f6dd688e651df9ee89ca3a69ff88cd0c)
2018-11-09malloc: Mitigate null-byte overflow attacksMoritz Eckert
* malloc/malloc.c (_int_free): Check for corrupt prev_size vs size. (malloc_consolidate): Likewise. (cherry picked from commit d6db68e66dff25d12c3bc5641b60cbd7fb6ab44f)
2018-11-09malloc: Verify size of top chunk.Pochang Chen
The House of Force is a well-known technique to exploit heap overflow. In essence, this exploit takes three steps: 1. Overwrite the size of top chunk with very large value (e.g. -1). 2. Request x bytes from top chunk. As the size of top chunk is corrupted, x can be arbitrarily large and top chunk will still be offset by x. 3. The next allocation from top chunk will thus be controllable. If we verify the size of top chunk at step 2, we can stop such attack. (cherry picked from commit 30a17d8c95fbfb15c52d1115803b63aaa73a285c)
2018-11-09Update syscall-names.list for Linux 4.18.Joseph Myers
This patch updates sysdeps/unix/sysv/linux/syscall-names.list for Linux 4.18. The io_pgetevents and rseq syscalls are added to the kernel on various architectures, so need to be mentioned in this file. Tested with build-many-glibcs.py. * sysdeps/unix/sysv/linux/syscall-names.list: Update kernel version to 4.18. (io_pgetevents): New syscall. (rseq): Likewise. (cherry picked from commit 17b26500f9bb926d85e86821d014f7c1bb88043c)
2018-11-09Add an additional test to resolv/tst-resolv-network.cAlexandra Hájková
Test for the infinite loop in getnetbyname, bug #17630. (cherry picked from commit ac8060265bcaca61568ef3a20b9a0140a270af54)
2018-11-08Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]H.J. Lu
Linkers group input note sections with the same name into one output note section with the same name. One output note section is placed in one PT_NOTE segment. Since new linkers merge input .note.gnu.property sections into one output .note.gnu.property section, there is only one NT_GNU_PROPERTY_TYPE_0 note in one PT_NOTE segment with new linkers. Since older linkers treat input .note.gnu.property section as a generic note section and just concatenate all input .note.gnu.property sections into one output .note.gnu.property section without merging them, we may see multiple NT_GNU_PROPERTY_TYPE_0 notes in one PT_NOTE segment with older linkers. When an older linker is used to created the program on CET-enabled OS, the linker output has a single .note.gnu.property section with multiple NT_GNU_PROPERTY_TYPE_0 notes, some of which have IBT and SHSTK enable bits set even if the program isn't CET enabled. Such programs will crash on CET-enabled machines. This patch updates the note parser: 1. Skip note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed. 2. Check multiple NT_GNU_PROPERTY_TYPE_0 notes. [BZ #23509] * sysdeps/x86/dl-prop.h (_dl_process_cet_property_note): Skip note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed. Update the l_cet field when processing NT_GNU_PROPERTY_TYPE_0 note. Check multiple NT_GNU_PROPERTY_TYPE_0 notes. * sysdeps/x86/link_map.h (l_cet): Expand to 3 bits, Add lc_unknown. (cherry picked from commit d524fa6c35e675eedbd8fe6cdf4db0b49c658026)
2018-11-06libanl: properly cleanup if first helper thread creation failed (bug 22927)Andreas Schwab
(cherry picked from commit bd3b0fbae33a9a4cc5e2daf049443d5cf03d4251)
2018-11-02x86: Fix Haswell CPU string flags (BZ#23709)Adhemerval Zanella
Th commit 'Disable TSX on some Haswell processors.' (2702856bf4) changed the default flags for Haswell models. Previously, new models were handled by the default switch path, which assumed a Core i3/i5/i7 if AVX is available. After the patch, Haswell models (0x3f, 0x3c, 0x45, 0x46) do not set the flags Fast_Rep_String, Fast_Unaligned_Load, Fast_Unaligned_Copy, and Prefer_PMINUB_for_stringop (only the TSX one). This patch fixes it by disentangle the TSX flag handling from the memory optimization ones. The strstr case cited on patch now selects the __strstr_sse2_unaligned as expected for the Haswell cpu. Checked on x86_64-linux-gnu. [BZ #23709] * sysdeps/x86/cpu-features.c (init_cpu_features): Set TSX bits independently of other flags. (cherry picked from commit c3d8dc45c9df199b8334599a6cbd98c9950dba62)
2018-11-02stdlib/tst-strtod-overflow: Switch to support_blob_repeatFlorian Weimer
This is another test with an avoidable large memory allocation. (cherry picked from commit 07da99aad93c9364acb7efdab47c27ba698f6313)
2018-11-02support_blob_repeat: Call mkstemp directory for the backing fileFlorian Weimer
This avoids a warning during post-test cleanup. (cherry picked from commit a91e9301c47bb688f4e496a19cfc68261ff18293)
2018-11-02stdlib/test-bz22786: Avoid memory leaks in the test itselfFlorian Weimer
(cherry picked from commit 60708030536df82616c16aa2f14f533c4362b969)
2018-11-02stdlib/test-bz22786: Avoid spurious test failures using alias mappingsFlorian Weimer
On systems without enough random-access memory, stdlib/test-bz22786 will go deeply into swap and time out, even with a substantial TIMEOUTFACTOR. This commit adds a facility to construct repeating strings with alias mappings, so that the requirement for physical memory, and uses it in stdlib/test-bz22786. (cherry picked from commit f5e7e95921847bd83186bfe621fc2b48c4de5477)
2018-11-02Test stdlib/test-bz22786 exits now with unsupported if malloc fails.Stefan Liebler
The test tries to allocate more than 2^31 bytes which will always fail on s390 as it has maximum 2^31bit of memory. Before commit 6c3a8a9d868a8deddf0d6dcc785b6d120de90523, this test returned unsupported if malloc fails. This patch re enables this behaviour. Furthermore support_delete_temp_files() failed to remove the temp directory in this case as it is not empty due to the created symlink. Thus the creation of the symlink is moved behind malloc. Reviewed-by: Carlos O'Donell <carlos@redhat.com> ChangeLog: * stdlib/test-bz22786.c (do_test): Return EXIT_UNSUPPORTED if malloc fails. (cherry picked from commit 3bad2358d67d371497079bba4f8eca9c0096f4e2)
2018-11-02Fix BZ#23400 (creating temporary files in source tree), and undefined ↵Paul Pluzhnikov
behavior in test. (cherry picked from commit 6c3a8a9d868a8deddf0d6dcc785b6d120de90523)
2018-10-26i64: fix missing exp2f, log2f and powf symbols in libm.a [BZ #23822]Szabolcs Nagy
When new symbol versions were introduced without SVID compatible error handling the exp2f, log2f and powf symbols were accidentally removed from the ia64 lim.a. The regression was introduced by the commits f5f0f5265162fe6f4f238abcd3086985f7c38d6d New expf and exp2f version without SVID compat wrapper 72d3d281080be9f674982067d72874fd6cdb4b64 New symbol version for logf, log2f and powf without SVID compat With WEAK_LIBM_ENTRY(foo), there is a hidden __foo and weak foo symbol definition in both SHARED and !SHARED build. [BZ #23822] * sysdeps/ia64/fpu/e_exp2f.S (exp2f): Use WEAK_LIBM_ENTRY. * sysdeps/ia64/fpu/e_log2f.S (log2f): Likewise. * sysdeps/ia64/fpu/e_exp2f.S (powf): Likewise. (cherry picked from commit ba5b14c7613980dfefcad6b6e88f913e5f596c59)
2018-10-26conform: XFAIL siginfo_t si_band test on sparc64Florian Weimer
We can use long int on sparcv9, but on sparc64, we must match the int type used by the kernel (and not long int, as in POSIX). (cherry picked from commit 7c5e34d7f1b8f8f5acd94c2b885ae13b85414dcd)
2018-10-22signal: Use correct type for si_band in siginfo_t [BZ #23562]Ilya Yu. Malakhov
(cherry picked from commit f997b4be18f7e57d757d39e42f7715db26528aa0)
2018-10-18Fix race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP ↵Stefan Liebler
[BZ #23275] The race leads either to pthread_mutex_destroy returning EBUSY or triggering an assertion (See description in bugzilla). This patch is fixing the race by ensuring that the elision path is used in all cases if elision is enabled by the GLIBC_TUNABLES framework. The __kind variable in struct __pthread_mutex_s is accessed concurrently. Therefore we are now using the atomic macros. The new testcase tst-mutex10 is triggering the race on s390x and intel. Presumably also on power, but I don't have access to a power machine with lock-elision. At least the code for power is the same as on the other two architectures. ChangeLog: [BZ #23275] * nptl/tst-mutex10.c: New File. * nptl/Makefile (tests): Add tst-mutex10. (tst-mutex10-ENV): New variable. * sysdeps/unix/sysv/linux/s390/force-elision.h: (FORCE_ELISION): Ensure that elision path is used if elision is available. * sysdeps/unix/sysv/linux/powerpc/force-elision.h (FORCE_ELISION): Likewise. * sysdeps/unix/sysv/linux/x86/force-elision.h: (FORCE_ELISION): Likewise. * nptl/pthreadP.h (PTHREAD_MUTEX_TYPE, PTHREAD_MUTEX_TYPE_ELISION) (PTHREAD_MUTEX_PSHARED): Use atomic_load_relaxed. * nptl/pthread_mutex_consistent.c (pthread_mutex_consistent): Likewise. * nptl/pthread_mutex_getprioceiling.c (pthread_mutex_getprioceiling): Likewise. * nptl/pthread_mutex_lock.c (__pthread_mutex_lock_full) (__pthread_mutex_cond_lock_adjust): Likewise. * nptl/pthread_mutex_setprioceiling.c (pthread_mutex_setprioceiling): Likewise. * nptl/pthread_mutex_timedlock.c (__pthread_mutex_timedlock): Likewise. * nptl/pthread_mutex_trylock.c (__pthread_mutex_trylock): Likewise. * nptl/pthread_mutex_unlock.c (__pthread_mutex_unlock_full): Likewise. * sysdeps/nptl/bits/thread-shared-types.h (struct __pthread_mutex_s): Add comments. * nptl/pthread_mutex_destroy.c (__pthread_mutex_destroy): Use atomic_load_relaxed and atomic_store_relaxed. * nptl/pthread_mutex_init.c (__pthread_mutex_init): Use atomic_store_relaxed. (cherry picked from commit 403b4feb22dcbc85ace72a361d2a951380372471)
2018-10-09i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK [BZ #23716]H.J. Lu
When elf_machine_runtime_setup is called to set up resolver, it should use _dl_runtime_resolve_shstk or _dl_runtime_profile_shstk if SHSTK is enabled by kernel. Tested on i686 with and without --enable-cet as well as on CET emulator with --enable-cet. [BZ #23716] * sysdeps/i386/dl-cet.c: Removed. * sysdeps/i386/dl-machine.h (_dl_runtime_resolve_shstk): New prototype. (_dl_runtime_profile_shstk): Likewise. (elf_machine_runtime_setup): Use _dl_runtime_profile_shstk or _dl_runtime_resolve_shstk if SHSTK is enabled by kernel. Signed-off-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 7b1f9406761331cf35fe521fbdb592beecf68a2c)
2018-10-09kl_GL: Fix spelling of Sunday, should be "sapaat" (bug 20209).Rafal Luzynski
Although CLDR says otherwise, it is confirmed by Oqaasileriffik, the official Greenlandic language regulator, that this change is correct. [BZ #20209] * localedata/locales/kl_GL: (abday): Fix spelling of Sun (Sunday), should be "sap" rather than "sab". (day): Fix spelling of Sunday, should be "sapaat" rather than "sabaat". (cherry picked from commit dae3ed958c3d0090838e49ff4f78c201262b1cf0)
2018-09-28Fix misreported errno on preadv2/pwritev2 (BZ#23579)Adhemerval Zanella
The fallback code of Linux wrapper for preadv2/pwritev2 executes regardless of the errno code for preadv2, instead of the case where the syscall is not supported. This fixes it by calling the fallback code iff errno is ENOSYS. The patch also adds tests for both invalid file descriptor and invalid iov_len and vector count. The only discrepancy between preadv2 and fallback code regarding error reporting is when an invalid flags are used. The fallback code bails out earlier with ENOTSUP instead of EINVAL/EBADF when the syscall is used. Checked on x86_64-linux-gnu on a 4.4.0 and 4.15.0 kernel. [BZ #23579] * misc/tst-preadvwritev2-common.c (do_test_with_invalid_fd): New test. * misc/tst-preadvwritev2.c, misc/tst-preadvwritev64v2.c (do_test): Call do_test_with_invalid_fd. * sysdeps/unix/sysv/linux/preadv2.c (preadv2): Use fallback code iff errno is ENOSYS. * sysdeps/unix/sysv/linux/preadv64v2.c (preadv64v2): Likewise. * sysdeps/unix/sysv/linux/pwritev2.c (pwritev2): Likewise. * sysdeps/unix/sysv/linux/pwritev64v2.c (pwritev64v2): Likewise. (cherry picked from commit 7a16bdbb9ff4122af0a28dc20996c95352011fdd)
2018-09-27Fix stack overflow in tst-setcontext9 (bug 23717)Andreas Schwab
The function f1a, executed on a stack of size 32k, allocates an object of size 32k on the stack. Make the stack variables static to reduce excessive stack usage. (cherry picked from commit f841c97e515a1673485a2b12b3c280073d737890)
2018-09-21i386: Use ENTRY and END in start.S [BZ #23606]H.J. Lu
Wrapping the _start function with ENTRY and END to insert ENDBR32 at function entry when CET is enabled. Since _start now includes CFI, without "cfi_undefined (eip)", unwinder may not terminate at _start and we will get Program received signal SIGSEGV, Segmentation fault. 0xf7dc661e in ?? () from /lib/libgcc_s.so.1 Missing separate debuginfos, use: dnf debuginfo-install libgcc-8.2.1-3.0.fc28.i686 (gdb) bt #0 0xf7dc661e in ?? () from /lib/libgcc_s.so.1 #1 0xf7dc7c18 in _Unwind_Backtrace () from /lib/libgcc_s.so.1 #2 0xf7f0d809 in __GI___backtrace (array=array@entry=0xffffc7d0, size=size@entry=20) at ../sysdeps/i386/backtrace.c:127 #3 0x08049254 in compare (p1=p1@entry=0xffffcad0, p2=p2@entry=0xffffcad4) at backtrace-tst.c:12 #4 0xf7e2a28c in msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=2) at msort.c:65 #5 0xf7e29f64 in msort_with_tmp (n=2, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #6 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=5) at msort.c:53 #7 0xf7e29f64 in msort_with_tmp (n=5, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #8 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=10) at msort.c:53 #9 0xf7e29f64 in msort_with_tmp (n=10, b=0xffffcad0, p=0xffffca5c) at msort.c:53 #10 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=20) at msort.c:53 #11 0xf7e2a5b6 in msort_with_tmp (n=20, b=0xffffcad0, p=0xffffca5c) at msort.c:297 #12 __GI___qsort_r (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4, cmp=cmp@entry=0x8049230 <compare>, arg=arg@entry=0x0) at msort.c:297 #13 0xf7e2a84d in __GI_qsort (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4, cmp=cmp@entry=0x8049230 <compare>) at msort.c:308 #14 0x080490f6 in main (argc=2, argv=0xffffcbd4) at backtrace-tst.c:39 FAIL: debug/backtrace-tst [BZ #23606] * sysdeps/i386/start.S: Include <sysdep.h> (_start): Use ENTRY/END to insert ENDBR32 at entry when CET is enabled. Add cfi_undefined (eip). Signed-off-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 5a274db4ea363d6b0b92933f085a92daaf1be2f2)
2018-09-21Fix strstr bug with huge needles (bug 23637)Wilco Dijkstra
The generic strstr in GLIBC 2.28 fails to match huge needles. The optimized AVAILABLE macro reads ahead a large fixed amount to reduce the overhead of repeatedly checking for the end of the string. However if the needle length is larger than this, two_way_long_needle may confuse this as meaning the end of the string and return NULL. This is fixed by adding the needle length to the amount to read ahead. [BZ #23637] * string/test-strstr.c (pr23637): New function. (test_main): Add tests with longer needles. * string/strcasestr.c (AVAILABLE): Fix readahead distance. * string/strstr.c (AVAILABLE): Likewise. (cherry picked from commit 83a552b0bb9fc2a5e80a0ab3723c0a80ce1db9f2)
2018-09-20Fix tst-setcontext9 for optimized small stacks.Carlos O'Donell
If the compiler reduces the stack usage in function f1 before calling into function f2, then when we swapcontext back to f1 and continue execution we may overwrite registers that were spilled to the stack while f2 was executing. Later when we return to f2 the corrupt registers will be reloaded from the stack and the test will crash. This was most commonly observed on i686 with __x86.get_pc_thunk.dx and needing to save and restore $edx. Overall i686 has few registers and the spilling to the stack is bound to happen, therefore the solution to making this test robust is to split function f1 into two parts f1a and f1b, and allocate f1b it's own stack such that subsequent execution does not overwrite the stack in use by function f2. Tested on i686 and x86_64. Signed-off-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 791b350dc725545e3f9b5db0f97ebdbc60c9735f)
2018-09-20misc: New test misc/tst-gethostidFlorian Weimer
The empty /etc/hosts file used to trigger bug 23679. (cherry picked from commit db9a8ad4ff3fc58e3773a9a4d0cabe3c1bc9c94c)
2018-09-20Linux gethostid: Check for NULL value from gethostbyname_r [BZ #23679]Mingli Yu
A NULL value can happen with certain gethostbyname_r failures. (cherry picked from commit 1214ba06e6771acb953a190091b0f6055c64fd25)
2018-09-10Fix segfault in maybe_script_execute.Stefan Liebler
If glibc is built with gcc 8 and -march=z900, the testcase posix/tst-spawn4-compat crashes with a segfault. In function maybe_script_execute, the new_argv array is dynamically initialized on stack with (argc + 1) elements. The function wants to add _PATH_BSHELL as the first argument and writes out of bounds of new_argv. There is an off-by-one because maybe_script_execute fails to count the terminating NULL when sizing new_argv. ChangeLog: * sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute): Increment size of new_argv by one. (cherry picked from commit 28669f86f6780a18daca264f32d66b1428c9c6f1)
2018-08-28regex: Add test tst-regcomp-truncated [BZ #23578]Florian Weimer
(cherry picked from commit 761404b74d9853ce1608195e24f25b78a910591a)
2018-08-28regex: fix uninitialized memory accessPaul Eggert
I introduced this bug into gnulib in commit 8335a4d6c7b4448cd0bcb6d0bebf1d456bcfdb17 dated 2006-04-10; eventually it was merged into glibc. The bug was found by project-repo <bugs@feusi.co> and reported here: https://lists.gnu.org/r/sed-devel/2018-08/msg00017.html Diagnosis and draft fix reported by Assaf Gordon here: https://lists.gnu.org/r/bug-gnulib/2018-08/msg00071.html https://lists.gnu.org/r/bug-gnulib/2018-08/msg00142.html * posix/regex_internal.c (build_wcs_upper_buffer): Fix bug when mbrtowc returns 0. (cherry picked from commit bc680b336971305cb39896b30d72dc7101b62242)
2018-08-27pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]Martin Kuchta
(cherry picked from commit 99ea93ca31795469d2a1f1570f17a5c39c2eb7e2)
generated by cgit v1.2.3-70-g09d2 (git 2.50.0) at 2025-08-09 04:09:01 +0000