AVX10_XMM, AVX10_YMM and AVX10_ZMM feature bits were from the earlier
version of AVX10 specification. Intel AVX10 specification published in
June 2026:
https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html
support both AVX2 and AVX512. These bits are reserved now and should
be 1. Set AVX10 active only if XMM/YMM/ZMM are supported and set
AVX10_VERSION active only if AVX10 is active.
This fixes BZ #34554.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Arjun Shankar <arjun@redhat.com>
IEEE 754 determines tininess after rounding from the result rounded to
the precision of the destination with an unbounded exponent range. Alpha
determines it from the delivered result instead, and the two differ
where a value is tiny but reaches the smallest normal once rounded,
since the spacing below the smallest normal is twice that of the binade
the unbounded rounding lands in. Alpha signals no underflow for such a
result, and the narrowing functions cannot recover it: no trap is taken,
so the kernel emulation never sees the operation, and the final
narrowing is a single conversion instruction that has already decided
the question.
Add a CHECK_NARROW_TINY hook, in a sysdeps header that generic code
defines to do nothing, and use it in the round-to-odd narrowing macros
and in fmaf. Round-to-odd already gives the right answer wherever
tininess follows IEEE 754, so nothing changes for architectures that do.
The narrowing macros bound the round-to-odd value only as a temporary,
so add, subtract, multiply and divide now name it; fused multiply-add
already did. NARROW_MIN_NORMAL selects the smallest normal of the result
type rather than taking it as a macro argument, which would have to be
threaded through every narrowing function. On architectures where the
hook is empty the preprocessor discards both arguments, so neither is
expanded.
fmaf is not a narrowing function but converts its double result to float
on return, and so has the same problem; route its returns through one
helper.
On x86_64 the generated code is unchanged: s_fdiv and s_fmaf are
identical with and without this, in both the static and shared builds,
once debug information is stripped.
On Alpha this fixes the twenty remaining math failures, all of the form
Exception "Underflow" not set, leaving math with no failures.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Fix multiple memory leaks in the locale program:
1. PUT (xstrdup (...)) leaks when tsearch finds a duplicate entry,
since tsearch returns the existing node and the newly allocated
string is orphaned. Introduce PUT_UNIQUE, which looks the name up
with GET first and only allocates when it is actually inserted.
2. String literals "POSIX" and "C" passed to PUT cannot be freed by
tdestroy. They now go through PUT_UNIQUE, which duplicates them,
so tdestroy (all_data, free) is safe.
3. Add tdestroy (all_data, free) at the end of write_locales and
write_charmaps to free the search trees.
4. Free dirents[cnt] entries in the scandir loop (only the dirents
array pointer was freed, not the individual entries).
5. Free alias_path allocated by argz_create_sep in write_locales.
Before this change "locale -a" leaked 74 bytes in 3 blocks directly
and 835 bytes in 49 blocks indirectly, and "locale -m" leaked 2190
bytes in 227 blocks. Both are valgrind-clean afterwards.
These leaks were reported by Arjun Shankar via GCC -fanalyzer
(OpenScanHub/Fedora).
Resolves: BZ #33972
Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com>
Reviewed-by: Arjun Shankar <arjun@redhat.com>
logb (+-0) is a pole error: it returns -Inf and raises the
divide-by-zero exception, but it never set errno, even though glibc
defines math_errhandling to include MATH_ERRNO.
Set errno in the zero branch that already exists in every logb
implementation, instead of adding a w_logb wrapper; the
USE_LOGB*_BUILTIN paths have no such branch, so add one there. The
double and float versions use __math_divzero and __math_divzerof.
There is no long double equivalent, so those keep the explicit
division and use math_opt_barrier to stop the compiler from folding
it away.
The i386 fxtract implementations of logb and logbf cannot set errno,
and adding the error handling to the assembly is not worthwhile, so
they are removed in favour of the generic C ones. s_logbl.c moves to
sysdeps/x86/fpu, replacing the x86_64 copy that only included it.
The manual described logb (0) as returning +Inf without signalling,
which was wrong in both respects.
Tested on x86_64-linux-gnu.
Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
DO_DIVBYZERO placed __divbyzero in .gnu.linkonce.t.divbyzero so that,
when building the PIC libc.so, every divide routine's copy collapses to
one. .gnu.linkonce is a pre-comdat-group GNU convention that no current
toolchain emits and that upstream lld has declined to support in full
generality, since a linked-to section from outside a group is not valid
ELF and every non-GNU-as producer has used SHT_GROUP comdat groups
instead for 25+ years.
BZ #20543 tracked this migration across glibc; i386's PIC-thunk section
was converted, but alpha's divide-by-zero handler was missed. Switch it
to the same "axG",@progbits,<sym>,comdat idiom already used by the i386
and sparc PIC-thunk sections, so it is deduplicated via a real ELF group
rather than section-name matching.
Divide routines reach the handler via `beq Y, DIVBYZERO`, a 21-bit
word-displacement branch (+-4MB range). The old .gnu.linkonce.t.* name
put the section in the default linker script's last .text bucket,
guaranteeing it trailed all other code; .text.__divbyzero lands one
bucket earlier alongside other .text.* input sections, so "last in
.text" is no longer guaranteed (PIC libc.so only; libc.a keeps per-file
copies). Measured on an alpha-unknown-linux-gnu build, __divbyzero
landed a few hundred bytes from the end of a ~1.6MB .text. An
out-of-range branch would fail the link with "relocation truncated to
fit" rather than produce a silently broken libc.
Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
The tests-printers-out rule in Rules wraps $(PYTHON) through
$(test-wrapper-env). Unlike ordinary tests, which wrap a freshly built
target binary, this wraps python3, a build-host tool. When cross-testing
with test-wrapper set (e.g. via scripts/cross-test-ssh.sh) the whole
command is forwarded to the target; if the target lacks python3 the shell
returns 127 and evaluate-test.sh reports the six nptl pretty-printer
tests as FAIL instead of UNSUPPORTED.
scripts/test_printers_common.py already exits UNSUPPORTED (77) when its
dependencies are missing, but that is unreachable when python3 itself is
absent.
Guard the invocation with a "command -v" check so the recipe exits 77
(UNSUPPORTED) when python3 is not found. Native builds are unaffected,
as configure requires python3.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Suggested-by: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
This goes on top of the fix for CVE-2026-18374. The test runs the
reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and
expects NULL with errno set to EINVAL.
Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
When fopen() is called with a ,ccs= parameter whose value becomes empty
after strip(), the code must reject it with EINVAL instead of attempting
to use it. The original upstr() fallback could read past the ',' delimiter
and cause a heap buffer overflow.
The fix checks if the charset specification is empty after strip() and
returns EINVAL immediately, preventing the overflow and following the
approach described in BZ #34574.
CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Reported-by: AISLE in partnership with Red Hat
Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Add smoke test verifying that getrusage returns non-negative user time and fails with invalid who value.
Co-authored-by: Frantisek Cech <fr.cech@proton.me>
Signed-off-by: Ondrej Marek <ondrejm4rek@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Commit 21841f0d56 ("PowerPC: Influence cpu/arch hwcap features via
GLIBC_TUNABLES") changed the INIT_ARCH() macro used by powerpc32/power4
and (via a one-line include) powerpc64 multiarch IFUNC resolvers to
read hwcap and hwcap2 through a direct
&GLRO(dl_powerpc_cpu_features)
reference, instead of the previous __GLRO() wrapper. The __GLRO() macro
performs a volatile NULL check on _rtld_global_ro, which matters because
IFUNC resolvers can run before _rtld_global_ro has been relocated for the
current library.
This regression triggers when a shared library's IFUNC symbol from libm
is resolved via BIND_NOW (full RELRO) before libm's own GOT is relocated:
the resolver's INIT_ARCH() then dereferences a NULL _rtld_global_ro and
segfaults at the hwcap load. The concrete failure seen was rsyslogd
crashing on startup on powerpc64 (e5500, BE) with
rsyslogd -> librsyslog -> libfastjson -> modf() IFUNC in libm
when libfastjson lacked a DT_NEEDED on libm, so libm was relocated after
libfastjson's IFUNC resolvers ran.
Restore the __GLRO()-based access for both hwcap and hwcap2, matching
the pre-2.41 behaviour and how use_cached_memopt is already read in the
same macro. This is a no-op once _rtld_global_ro is fully initialised
and simply reinstates the early-startup NULL guard.
Add a regression test (ppc64 only; ppc32 has additional early-startup
constraints that make the same test infeasible there). The module is
linked with -z,now and intentionally has no DT_NEEDED on libm, so the
IFUNC resolver for modf() runs before libm is fully relocated.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The reference implementation renders the a and A conversions by
splitting the value into a significand of the width the type has and a
power of two. That presumes the type is a single binary floating-point
format. The IBM extended format is a pair of doubles instead, whose
combined significand has no fixed width and whose subnormals are those
of the low double rather than of the type, so what glibc produces for it
does not follow from PREC and MINEXP: LDBL_MAX comes out as
0x1.fffffffffffff7ffffffffffff8p+1023 with twenty-eight fractional
digits where the value has at most twenty-six worth of significand, and
LDBL_TRUE_MIN as 0x0.0000000000001p-1022, which is the smallest
subnormal double and nowhere near LDBL_MIN_EXP.
The remaining conversions are unaffected, as they work from the value
rather than from a decomposition of it, and were verified to be.
Add an UNSUPPORTED_CONVS definition to the skeleton for conversions that
cannot be modeled for the type at hand, and set it to the a and A pair
where long double has that format, the generator then producing no
records and an unsupported status which the long double wrapper reports.
Tested on x86_64-linux-gnu and powerpc64le-linux-gnu, where all 672
results pass, and with the long double conversions forced to the IBM
extended format, where the a and A ones report unsupported and the rest
continue to pass.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The reference implementation used to verify the a and A conversions
assumed the value it was given was normal, splitting it into a
significand of the full width and an exponent. That is not true below
the smallest normal value, where the exponent can go no lower and the
significand loses bits from the top instead, which is what makes the
leading hexadecimal digit of a subnormal come out as zero. Given a
subnormal it would have produced a normalized result such as 0x1p-1070
where we print 0x0.000000000001p-1022.
Telling the two apart needs the minimum exponent for the type, which was
not among the data the test program supplies, so add it as a MINEXP
definition reported in a record of its own next to the working
precision. Then stop normalizing once that exponent is reached, and pad
the digits produced on the left, as there are no longer enough of them
to fill the field on their own. The remaining conversions are
unaffected: they work from the value itself and never needed it
decomposed.
How far the exponent has to be shifted to sit after the significand
depends on the working precision, so hold MINEXP as reported and combine
the two only once a value is due to be converted, rather than requiring
the records to arrive in a particular order. Where no MINEXP record
arrives the type has no subnormals and no clamping is applied.
None of the values iterated over were subnormal, so this could not be
observed. Add DBL_TRUE_MIN and LDBL_TRUE_MIN to cover it, which also
exercises the smallest exponent with the remaining conversions. How
many bits the leading hexadecimal digit holds varies with the type, one
for a 53 bit significand and four for a 64 bit one, so both are needed:
the wider case lands on a different exponent than the minimum for the
type, with LDBL_TRUE_MIN coming out as 0x0.000000000000001p-16385 rather
than at the p-16382 that the leading digit of a normal value would sit
at. One sign is enough for either, as nothing in the sign handling
depends on the value being subnormal, and the records these produce are
among the most expensive in the test suite.
Tested on x86_64-linux-gnu, where all 672 results pass.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The a and A conversions were left out when the formatted printf output
tests were added, because gawk produces output that differs from ours,
using insufficient precision where none has been given and choosing a
different exponent otherwise. Verification no longer goes through AWK,
and computing the reference output directly makes them straightforward,
so cover them now.
The significand is written out as it stands, which means the leading
hexadecimal digit holds whatever bits are left over once the remaining
ones are grouped into whole digits: one bit for a 53 bit significand, so
the digit is 1, and four for a 64 bit one, so it runs from 8 to f.
Rounding to a requested precision can carry out of that digit, in which
case the result is re-expressed with one digit fewer and the exponent
raised by four rather than the integer part being widened. The 0x
prefix precedes any '0' flag padding, as it does for the integer
hexadecimal conversions.
Unlike the remaining floating-point conversions these produce different
digits for an omitted precision than for one of 6, so key the memoized
digits on the precision as given rather than as defaulted.
Tested on x86_64-linux-gnu, where all 672 results pass.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The b and B conversions were left out when the formatted printf output
tests were added, because gawk does not handle them at all.
Verification no longer goes through AWK, so cover them now.
They follow the existing integer conversions, with the alternative form
producing the 0b or 0B prefix for a nonzero value.
Note that B was listed for neither the '#' and '0' flags nor precision,
so add it to those lists next to b, as otherwise most of its records
would never be produced.
Tested on x86_64-linux-gnu, where all 576 results pass.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The formatted printf output tests verify their records against GNU AWK,
relying on it to provide an implementation of format processing that is
independent from ours.
AWK has to run in the bignum mode for the floating-point conversions,
because otherwise it uses the system sprintf(3) internally and we end up
verifying our code against itself. That in turn makes gawk compiled
with MPFR support a requirement for testing the library at all. Beyond
that gawk mishandles a number of cases which the AWK script then has to
undo by hand: the extraneous leading 0 produced for the alternative form
with the octal conversion, the 0 produced where no characters are
expected for the hexadecimal conversions, the missing + and space
characters for a zero value with the precision of zero, and a collection
of sign, flag and field width anomalies for Inf and NaN values. Each
such workaround suppresses whatever we might get wrong in the same
place. The a, A, b, and B conversions cannot be verified at all,
because gawk either does not handle them or produces different output.
Replace the AWK script with an equivalent one written in Python, which
is already a requirement for building the library. Rather than calling
into any formatting routine it computes the reference output directly,
using exact integer and rational arithmetic. Working exactly means the
result does not depend on the range or precision of any host
floating-point type, so the wider types are handled without
arbitrary-precision arithmetic having to be built into the interpreter,
and none of the workarounds listed above are needed: the corner cases
they cover are computed correctly. The same property removes the reason
the a, A, b, and B conversions had to be left out; adding them is left
for the commits that follow. Rendered digits are memoized per value,
without which the exact arithmetic makes the long double conversions
slower than AWK.
As the capability probes only ever detected gawk build options, they go
away along with the unsupported status they could produce, so the f and
F conversions are now always verified rather than silently skipped where
gawk was built without them. Drop the corresponding note on MPFR from
the installation instructions.
Tested on x86_64-linux-gnu, where all 576 results continue to pass.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The file does not actually show up as reachable until getting linkat'ed,
which makes it 000 with the current ext2fs, but better make the filesystem
record proper mode anyway.
As documented by posix & linux, if the real ID is set or the effective ID is
set to a value not equal to the previous real ID, the saved ID shall be set
to the new effective ID.
The strto* declarations in stdlib.h are marked __nonnull, but the
corresponding declarations in inttypes.h and wchar.h are not. Add the
attribute there as well, covering the __REDIRECT and __isoc23_* variants
and the _l forms, matching stdlib.h.
Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
For AT_SECURE programs the loader honors $ORIGIN in DT_RPATH only when the
expansion is rooted in a trusted directory, but it validated the lexically
normalized path while opening the raw expansion. As "a/b/../c" only names
"a/c" when "b" is not a symlink, an attacker who controls a component of
$ORIGIN -- e.g. by hard-linking the setuid binary into an attacker-owned
directory -- can make the opened path escape the trusted directory even
though the check passed, loading an attacker-controlled object.
Normalize the expansion in place and open that, so the path that is opened
is exactly the path that was validated. _dl_normalize_path rewrites the
string in place without ever advancing its write cursor past its read
cursor or appending, so it stays within the original storage.
Add elf/tst-origin-secure as a regression test.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The reference to MAP_NORESERVE and /proc/sys/vm/overcommit_memory was
moved from proc(5) to proc_sys(5) in man-pages commit bfc1299e7 (proc.5,
proc_sys.5: Split /proc/sys/ from proc(5), 2023-08-15). It was
subsequently moved to proc_sys_vm(5) in man-pages commit
b06cd070f (proc_sys.5, proc_sys_vm.5: Split /proc/sys/vm/ from
proc_sys(5), 2023-09-30).
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Largely auto-generated, using glibc-specific interfaces, and
following (manually-written) sysdeps/pthread/tst-robust12.c.
Assisted-by: LLM
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
This allows priority-protect tests to be regular tests. They
exit with EXIT_UNSUPPORTED if the process does not have sufficient
privileges.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Also fix __pthread_tpp_change_priority to undo changes to the priomap
array if any of the scheduler system calls fail.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
For some error scenarios, the robust list head is left pointed at
the mutex after the return. This can cause the kernel to update
the mutex lock field after it has been reallocated for something
else.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The non-PI case already does this:
/* Work around the fact that the kernel rejects negative timeout
values despite them being valid. */
if (__glibc_unlikely (abstime->tv_sec < 0))
return ETIMEDOUT;
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The g and G conversions choose between the f and e styles according to
the exponent the value has once rounded to the requested number of
significant digits. Where the value is small enough for the f style but
rounding then carries into a new decade, printf_fp rewrites the digits
it has already produced into the e style, recomputing along the way how
many fractional digits the leading digit now leaves room for.
FRACDIG_MIN, which the alternative form sets to the number of fractional
digits that have to be retained rather than stripped, was left behind at
the value computed for the f style. Where the value filled the whole
integer part that is zero, so all the fractional digits were then
stripped from a result the '#' flag requires to keep them:
printf ("%#.2g", 99.9) gave "1.e+02" rather than "1.0e+02"
printf ("%#g", 999999.9) gave "1.e+06" rather than "1.00000e+06"
Update FRACDIG_MIN along with FRACDIG_MAX. Without the alternative form
nothing retains trailing zeros, so the outcome is unchanged there.
None of the values the conversion tests iterate over round this way, so
add one that does at a precision they cover.
Tested on x86_64-linux-gnu.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
HUGE_WIDTH is chosen so that none of the strings produced are truncated,
which for the floating-point types means every record it takes part in
carries hundreds or thousands of digits. Those records dominate the
cost of this whole family of tests: for the long double conversions they
are 99% of the bytes produced, and the long double targets alone account
for 92% of the time the tests take.
The digits being checked are produced by the same conversion code
whichever of the printf family of functions is used; what differs
between the twelve of them is the sink the result is written to, which
the smaller widths cover already.
Iterate over HUGE_WIDTH for a single function then, chosen as printf,
and let the remaining eleven stop at MID_WIDTH. This applies to the
double and long double conversions only; for the other types
full-precision output is short and costs nothing, so they keep iterating
over it as before.
Together with the switch to verifying in Python this takes the tests
from 935s to 375s of processor time on x86_64-linux-gnu, with all 576
results continuing to pass. What remains is mostly intrinsic: the f and
F conversions print the whole integer part regardless of the precision
requested, so LDBL_MAX runs to some 4932 digits even at MID_WIDTH.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Since af34b1376a ("elf: Initialize static TLS before relocation
processing", BZ 34164) dropped the 'defer-if-not-relocated' branch in
_dl_try_allocate_static_tls, nothing sets l_need_tls_init any more. The
second pass in update_tls_slotinfo, guarded by l_need_tls_init, is
therefore dead: its _dl_update_slotinfo / _dl_init_static_tls calls never
run, and the static TLS image is initialised inline during relocation (IE
model) or lazily on first dynamic-TLS access instead.
Remove the dead loop, the now write-only l_need_tls_init field and its
clear in _dl_allocate_tls_init. No functional change.
Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu.
I also run the elf tests on armv7-a, alpha, loongarch64, mips64le,
powerpc, riscv, and s390x using qemu system.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The initial static-pie support (commit 9d7a3741c9) reused
ld.so ELF parsing logic, even though RPATH/RUNPATH should not appear
in the static-pie bootstrap. With static PIE, RPATH/RUNPATH on the
loader typically indicates a toolchain misconfiguration. However,
for static PIE, the presence of RPATH/RUNPATH has no impact because
these binaries do not use dynamic linking at runtime.
Fully static binaries have no dynamic section, so RPATH/RUNPATH can not
appear there at all; for static PIE the only consumer is dlopen. If
static dlopen support is ever removed, this change becomes a no-op.
This change also simplifies elf_get_dynamic_info and removes a
difference between dynamic and static binaries, along with the now
unused STATIC_PIE_BOOTSTRAP.
Tested on aarch64-linux-gnu and x86_64-linux-gnu.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The BZ#33326 testcase triggers an assertion during process startup,
which results in a segmentation fault instead of an error message
and process termination with a SIGABRT. The assert issues
__libc_message_impl, which in turn might call string functions
depending on the ABI (strchrnul, strlen, memcpy/mempcpy), system
calls (writev and mmap), and finally the abort call.
The dl-symbol-redir-ifunc.h is also expanded to cover strchrnul on
x86_64, s390, powerpc64 (both endianness) and loongarch, mempcpy on
powerpc64be, and memcpy on aarch64. On s390 the redirection is only
issued if the ifunc variant is built, since strchrnul-c.c only renames
the C implementation to STRCHRNUL_DEFAULT when HAVE_STRCHRNUL_IFUNC is
set.
The buffer that backs up the assert message is now allocated through
_dl_mmap, which issues the syscall directly instead of calling __mmap
(setting errno on failure requires the thread pointer).
The abort call now issues __raise_direct instead of raise (the Hurd
port aliases __raise_direct to raise).
On i386, syscalls should not use the vDSO during program startup because
the thread pointer is not yet initialized. This requires __raise_direct,
_dl_writev, and _dl_mmap to be built with I386_USE_SYSENTER set to 0.
Creating a test case is challenging. For static-pie, the assert is only
called for ill-formed ELF files on elf_get_dynamic_info and by some targets
on ELF_DYNAMIC_RELOCATE (although not all targets use assert in their
dl-machine.h). Some targets also issue __libc_fatal on ARCH_SETUP_IREL,
but also only for ill-formatted ELF files.
The test employs a different strategy and overrides the __tunables_init
symbol, which is invoked immediately before self-relocation and TLS setup.
The test is built with -Wl,-z,muldefs to avoid linker issues.
I checked on aarch64, x86_64, i686, s390x (qemu), sparc (qemu),
mips64el (qemu), armhf, riscv, and powerpc.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
And change _dl_writev to return a negative errno in case of failure.
This keeps the required semantics for not setting errno on failure
and allows removing the Linux libc_fatal.c implementation.
It also makes it simple to use the writev syscall during process
startup, especially on i386, where it requires disabling vDSO.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
.. and openat64.
Linux 7.2 (31cf44efa6df72a524b40adefb80539f3a4e13ba) allows openat, openat2
to take a NULL path with the new O_EMPTYPATH flag, so the nonnull attribute
is no longer sound. Drop it.
Bug: https://sourceware.org/PR34313
Reviewed-by: Paul Eggert <eggert@cs.ucla.edu>
Since Linux 6.11, AT_EMPTY_PATH can be used for a NULL path argument, so
the nonnull attribute is no longer sound. Drop it.
This bug was worked around in gnulib's 6db27b4dd36eda618db20e997ff56bbed7fce3cb.
See also 55618e1396 which fixed fstatat
in glibc.
Bug: https://sourceware.org/PR34313
Reviewed-by: Paul Eggert <eggert@cs.ucla.edu>
This makes the tests the same in both places. The changes in Gnulib
brought in by this patch also silence -Woverflow when using gcc 16.1.1
on i686.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
This patch changes the behavior of pthread_mutex_lock in case of
non-trivial deadlock. The user-space code doesn't detect the case
where two or more threads would mutually deadlock each other, but the
Linux kernel can. NPTL's previous behavior, if the syscall returns
EDEADLK, was to run into an assertion.
With this patch:
- For error-checking PI mutexes; the error code will be propagated to
the caller who might then, at its own discretion and with knowledge
about the application-level logic, use it to attempt resolving the
situation gracefully or terminate the process after all. Since
error-checking mutexes are specified to possibly return EDEADLK,
and the only reason to use them in the first place is for the sake
of these additional error checks, any calling code failing to check
the return code in this case may legitimately be considered broken
already.
- For recursive mutexes; the thread will actually deadlock instead of
failing the assertion. It has been discussed (see below) that this
might be more conservative as, unfortunately, lots of existing code
might be guilty of not always checking the return code. So
returning at all in this case might cause (arguably questionable)
code to continue executing undefined behavior by falsely assuming
that the thread successfully acquired a lock, which it didn't.
- For all other mutex types; the behavior is not changed. They will
continue to actually deadlock the calling thread as they did prior
to this patch.
A new test is added to assert the expected behavior of all mutex
types.
Since POSIX doesn't seem to mandate any particular behavior for this situation,
and no existing code should have a dependency of running into an assertion,
changing this behavior to what is presumably the most useful one seems to be
justified.
The previous (design) discussions can be seen here:
https://sourceware.org/pipermail/libc-alpha/2025-December/173431.htmlhttps://sourceware.org/pipermail/libc-alpha/2026-April/176406.html
Signed-off-by: Moritz Klammler <moritz.klammler.ext@siemens.com>
Commit a2b0ff98a0 added __attribute_optimization_barrier__ and converted the
users of __attribute__ ((noinline, noclone)) to it, so that Clang, which does
not implement noclone, gets optnone instead of an unknown-attribute warning
that is an error under -Werror.
Twelve users were missed, all of them in code that a plain x86_64 build never
preprocesses, which is why they survived the sweep:
- libio/tst-stderr-compat.c is inside
#if TEST_COMPAT (libc, GLIBC_2_0, GLIBC_2_1), so it is compiled only on
ports that still have GLIBC_2.0 compat symbols -- i686 and alpha among
them, but not x86_64. Building it with Clang fails.
- The eleven sysdeps/x86_64/x32/tst-size_t-*.c tests are built only for the
x32 ABI.
No functional change for GCC, which still gets noinline and noclone.
Checked that both shapes -- the weak function in libio and the static function
in the x32 tests -- compile with GCC and with Clang after the change, and that
the pre-change shape is an error under Clang with -Werror.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The fts and fts64 interfaces can share an implementation only when
both their offset and inode types have matching layouts.
The existing conditions check only whether off_t and off64_t match.
On Alpha, these types match, but ino_t and ino64_t differ.
Consequently, FTSENT and FTSENT64 have different layouts.
The ordinary fts implementation is therefore omitted on Alpha, and
the ordinary fts symbols are instead aliased to the fts64
implementation. This causes the ordinary interface to operate on an
incompatible FTSENT64 layout and corrupts traversal state.
Build the ordinary implementation unless both the offset and inode
types match. Likewise, alias the ordinary symbols to the fts64
implementation only when both types match.
An audit of the bits/typesizes.h implementations shows that Alpha is
the only ABI where __OFF_T_MATCHES_OFF64_T is defined but
__INO_T_MATCHES_INO64_T is not. Therefore, this changes the
implementation selection only on Alpha.
This fixes io/tst-fts, io/tst-fts-bz22944, and io/tst-fts-newflags on
Alpha.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
In a few places, we weren't exiting w/ 77 when skipping. Fix that by using
our standard macro for it.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Bangla has no conventional abbreviated form for month names. The
existing abmon entries only truncated January and February ("জানু",
"ফেব"), while March through December were already spelled out in
full -- an inconsistent and non-standard %b output that native
speakers do not recognize as valid abbreviations. "জানু" is also an
unrelated, existing Bengali word meaning "knee".
Use the full month name for abmon as well as mon in both bn_BD and
bn_IN, matching the informal convention already used for the other
ten months and consistent with CLDR's bn Gregorian calendar data,
which likewise leaves several months unabbreviated for the same
reason (see CLDR-19739, filed separately for the CLDR side of this:
https://unicode-org.atlassian.net/browse/CLDR-19739).
Signed-off-by: Azharul Haque <haque@azharul.com>
Reviewed-by: Mike FABIAN <mfabian@redhat.com>
The security team has been scoring issues recently, so also add the
score to the advisory file as the single source of truth. Document the
new tag in README.
Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Add memory clobber for writing to the POR_EL0 register since a change
to this register affects subsequent memory accesses.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The memmove call did not take into account that __printf_buffer_pad
updated the buffer pointers.
Fixes commit e88b9f0e5c
("stdio-common: Convert vfprintf and related functions to buffers"),
which went into glibc 2.37.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
commit 6deadd4eb6
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Wed Oct 8 10:55:05 2025 -0300
didn't remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c. As the result,
due to a linker bug:
https://sourceware.org/bugzilla/show_bug.cgi?id=34550
there were 2 default versions of fmod in m68k libm:
996: 0001433c 174 FUNC WEAK DEFAULT 12 fmod@@GLIBC_2.0
997: 000307d4 214 FUNC GLOBAL DEFAULT 12 fmod@@GLIBC_2.43
Add check-symbol-version.awk to verify that versioned symbols only have
one default version in dynamic symbol table.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sam James <sam@gentoo.org>
Previously, add_system_dir added different paths depending on the ABI:
ilp32d: /lib32
ilp32s: /lib32/sf
Now, add_sysmtem_dir adds all of the following directories to standard
search path for both ilp32d ABI and ilp32s ABI:
/lib
/lib32
/lib32/sf
/lib64
/lib64/sf
This change fixes elf/tst-ptrguard-static-dlopen on ilp32s ABI.
The test is a statically linked executable with dlopen
tst-ptrguard-static-dlopen-mod.so. Without this patch, the test fails
because it looks for ld.so in /lib32/sf, but the file is actually
in /lib32.
LoongArch32 Reduced has no rotri.d/rotri.w instructions.
Use slli.w/srli.w/or to synthesize the rotation on LoongArch32
and LoongArch32 Reduced.
Reported-by: Haiyong Sun <sunhaiyong@loongson.cn>
The bug only exists in the non-FMA-contracted compilation of that
branch. On x86_64 it can be triggered with:
GLIBC_TUNABLES=glibc.cpu.hwcaps=-AVX2 math/test-double-tanh
Or by building without ifunc support.
Checked on aarch64-linux-gnu and x86_64-linux-gnu with
--disable-multi-arch.
Several tests rely on a madvise syscall to appear in strace output
(or not appear in case of 'disable' tests). This syscall may occur
in malloc. To avoid this from happening, we use malloc tunable to
disable hugetlb for these tests.
Suggested-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
A string tunable value usually references the GLIBC_TUNABLES (or alias)
environment string, which lives in the environment block the kernel places
on the initial stack. That memory is owned by the application, which may
overwrite it (e.g. setproctitle), so the reference is only safe while no
application code has run (a value coming from the system-wide tunables
cache is a copy instead, but the rule is applied uniformly).
This patch make the lifetime explicit and enforced without copying the value
or allocating any memory by adding __tunable_seal_strings, which drops every
string tunable reference once early startup is complete.
The seal is applied after the only string tunable consumer and before any
code outside of the startup sequence runs.
Checked on aarch64-linux-gnu and x86_64-linux-gnu. I also run the elf
tests on powerpc64le-linux-gnu, loongarch64-linux-gnuf64, and
s390x-linux-gnu.
The WRDE_APPEND path duplicates the caller's we_wordv array, which
already holds we_offs + we_wordc + 1 pointers. Follow-up to commit
e2cefe16c3.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Commit 24d188a2a1 left a stray #endif in
the powerpc32 soft-float __longjmp-common.S. Remove it, matching the
fpu variant.
Checked with a build for powerpc32-linux-gnu-soft.
The libc.so linker script generated by "make install" references the
dynamic linker via an AS_NEEDED entry so the linker can resolve it
while building against libc. Previously this used \$(rtlddir), which
is also the path compiled into ld-linux as its self-identification
string (-DRTLD in elf/Makefile) and used for the PT_INTERP of glibc's
own binaries (installed-rtld-LDFLAGS in Makeconfig).
These two uses legitimately differ when glibc is built to run on a
different environment with a different filesystem structure than the
build system: the loader is installed under the build tree, but the
resulting binaries must reference it via the runtime path of the
target environment. Setting \$(rtlddir) to that runtime path makes
libc.so point at a loader that is not present at build time, breaking
linking against libc and later consumers such as binutils.
Introduce \$(rtlddir-build), defaulting to \$(rtlddir), and use it for
the libc.so AS_NEEDED entry so it tracks where the loader is actually
installed. \$(rtlddir) keeps driving the runtime path
(self-identification and PT_INTERP). This is a no-op for the default
configuration, where rtlddir-build == rtlddir == slibdir.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
On MIPS64 and AArch64 systems with 16-KiB pages, the PMD size is 32MB.
As we already have multiple platforms requiring such a large size and
it's the maximum THP size we support to align the load segments, it's
easier to raise the default instead of adding more special cases.
Link: https://sourceware.org/glibc/wiki/Testing/Tests/elf/tst-thp-1
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
POSIX.1-2024 requires memmem, strlcpy, and strlcat in <string.h>, and
wcslcpy and wcslcat in <wchar.h>. Expose these declarations and their
fortified wrappers under __USE_XOPEN2K24 as well as __USE_MISC. Keep
mempcpy restricted to __USE_MISC.
Add declaration tests for POSIX and X/Open Issue 8 modes, including
fortified headers.
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
The nscd init script calls for #! /bin/bash interpreter since it uses
bash specific extentions namely (translated strings) and echo -n
command, replace echo with printf and switch the shell interpreter to
Reviewed-by: Sam James <sam@gentoo.org>
The single-accept-character fast path was a byte-at-a-time scalar loop.
Scan a word at a time instead, using find_ne_all () to locate the first
byte that differs from the broadcast accept character. ACCEPT[0] is not
NUL here, so a NUL byte differs from it and the search for inequality
also stops at the end of the string.
The word loop compares against the broadcast character directly rather
than building a mask each iteration, and calls find_ne_all () once at the
end. Where find_ne_all () is an exclusive or the compiler already
generated this, but alpha builds the mask with cmpbge, and the comparison
halves its loop.
The multi-character case keeps the existing bitmap-table scan.
Checked against strspn () for lengths 0 to 300 at every byte alignment,
for several accept characters, with the run ended both by NUL and by a
differing byte. Run on alpha (EV68CB), powerpc64 big-endian, 32-bit arm,
aarch64 and x86_64, covering the cmpbge, cmpb, uqsub8 and generic C
string-fza.h implementations. The riscv ones were built but not run.
Speedup over the scalar loop it replaces:
length 8 32 128 512 2K 8K 32K
Alpha EV68 1.3x 3.3x 5.2x 11.7x 15.2x 16.4x 16.9x
i7-1370P 1.9x 2.8x 5.5x 4.0x 5.2x 6.9x 7.6x
Both are the best of seven timed runs of each implementation, each run
calibrated to at least 0.3 s so that the millisecond clock granularity on
alpha does not quantize the result, and built with -falign-functions=64
so that code placement does not dominate the short lengths. The i7-1370P
reaches this code only where SSE4.2 is unavailable, since the generic C
string-fza.h is what it would use there.
Suggested-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
Build the mask from the raw difference, as find_ne_all () now does.
index_first () and index_last () only need to know which byte holds the
first or the last set bit, and find_zero_all () marks only the bytes that
were zero, so each term of the or marks only its own bytes.
That drops one of the two carry chains from strcmp () and strncmp () on
targets using the generic string-fza.h, and one of the two uqsub8 on
armv6t2. As in find_ne_all (), only the generic implementation tests
HAVE_BITOPTS_WORKING.
powerpc keeps its existing form, where orc folds the complement of cmpb
into the or and the raw difference saves nothing. alpha and riscv do not
reach this code with the generic index_first ().
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
find_zero_ne_all () searches for a zero byte in X1 or a byte that differs
between X1 and X2. A caller that knows X2 contains no NUL byte does not
need the zero test, since a NUL byte in X1 already differs from every
byte of X2.
Add find_ne_all (), which searches for inequality alone, to the generic
implementation and to each target that provides its own string-fza.h.
Dropping the zero test makes it cheaper than find_zero_ne_all () on every
target.
Return the difference unreduced wherever index_first () and index_last ()
come from the generic string-fzi.h, which uses stdc_trailing_zeros () and
stdc_leading_zeros () and so only needs to know which byte holds the first
or the last set bit. That covers armv6t2, powerpc and riscv with the
bitmap extensions, as well as the generic implementation. Only the
generic one tests HAVE_BITOPTS_WORKING, since its fallback ctzb () and
clzb () isolate a single bit and expect it at 0x80; the target masks are
already incompatible with that fallback and cannot use it either way.
riscv without the bitmap extensions takes its string-fza.h from the
generic implementation while defining its own index_first () and
index_last (), which tested bit 7 of each byte. Test the whole byte
instead, so that they accept the unreduced difference.
alpha keeps a reduced form, its find_t being a cmpbge mask of one bit per
byte throughout.
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
_dl_sort_maps is only called during shared object loading and
unloading, not on any hot path. The branch predictor hint has no
measurable benefit, and removing it simplifies the code and avoids
future maintenance when the default algorithm changes.
Suggested-by: Wilco Dijkstra <wilco.dijkstra@arm.com>
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
Introduce ifuncs and resolvers for functions pertinent to the
malloc interface on the AArch64 target: malloc, calloc, free,
realloc, memalign, valloc, pvalloc, posix_memalign, aligned_alloc,
free_sized, free_aligned_sized, malloc_usable_size.
A target can define the USE_MULTIARCH_MALLOC macro. In this case
it must provide alternative aliases for the malloc functions that
point to the ifuncs.
This implementation respects the --disable-multi-arch configure
flag. If multi-arch support is disabled, the generic aliases
are used on aarch64.
This patch contains aarch64-specific resolvers. At this point they
return core implementations but in the future they can be changed
to support for features, e.g. to handle memory tagging.
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
This commit moves declarations for various malloc functions from
the malloc.c file to a separate header that can be used to include
these declarations in other source files.
No functional change intended.
Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
These merely delay the inevitable on 32-bit architectures.
Growing a buffer one character at a time is very slow, so this
could lead to even more processing time for very large inputs.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
This avoids theoretical integer overflow issues on 32-bit
architectures. The overflow is not reachable since glibc 2.30
because doubling reaches a size larger than PTRDIFF_MAX, at which
point realloc fails due to commit 9bf8e29ca1 ("malloc:
make malloc fail with requests larger than PTRDIFF_MAX (BZ#23741)").
The non-doubling path is used instead. Eventually, the size
increments also pass PTRDIFF_MAX, so the fallback realloc fails, too.
This means that in current glibc, there is no crash.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
After commit 78f1f0e39c ("Consolidate
the C pointer guard and align the assembly implementations"),
PTR_DEMANGLE3 on POWER no longer atomically updates the destination
register. The fortified longjmp relies on atomic update of the
stack pointer (r1) in sysdeps/powerpc/powerpc64/__longjmp-common.S
and parallel files:
#ifdef PTR_DEMANGLE
# ifdef CHECK_SP
PTR_DEMANGLE3 (r22, r22, r25)
# else
PTR_DEMANGLE3 (r1, r22, r25)
# endif
#endif
Fix this by using PTR_DEMANGLE instead of PTR_DEMANGLE3. Remove
PTR_MANGLE3 and PTR_DEMANGLE3 as unused.
An alternate fix would store the pointer guard cookie rotated,
but this would go against the unification in the commit that
introduced the regression.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Increase iterations for strpbrk/strspn so they run for at least 0.5s.
Reduce iterations for the much slower wcs* variants since they take over 10s.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The documentation for system-wide tunables had an example for
overridability that used 0/1 as values for glibc.cpu.x86_shstk. Use the
correct on/off string values instead.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
It is not thread-safe. Furthermore, the cache invalidation logic did
not account for deallocation in uselocale (which could change the regexp
without changing its pointer).
Given that this code is unlikely to be performance-senstive
(it is for interactive use) and the regular expressions are very
short, allocate and deallocate the regular expressions on each
call.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
The test skeleton was auto-generated. I think this is fine because
the harness is so specific to glibc.
Assisted-by: LLM
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Pass the number of bytes written by recvfrom, not the entire size
of the buffer.
This is not a security vulnerability because it only allows
confirmation of previously existing buffer values. All reads stay
within the specified buffer bounds. The buffer contents may not have
been initialized. Subsequent processing is correctly capped at buffer
bounds, too.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The __libc_res_nameinquery function returns -1 for corrupted packets.
The previous code treated those as matching.
This is not a security vulnerability because the transaction ID is
still checked. The bug does not make off-path attacks substantially
easier. Furthermore, most users of the DNS stub resolver parse the
question name again, and do not simply skip over it using dn_skipname
or similar (which would hide the corruption). This means that the
packet is still rejected at a later stage.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
This can be used to mangle the response data to exercise the
DNS client with corrupted packets.
Also change resolv_response_buffer not to allocate. Instead,
just return a pointer to the internal buffer. The function is
currently unused.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Commits 6deadd4eb6 and ade9f30ce2 changed m68k fmod to call
__m81_u(fmod), instead of the mathimpl.h inline
__m81_u(__ieee754_fmod) (that wraps the m68k fmod instruction).
This leads to infinite recursion.
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
The three resolver translation units are compiled with
-fstack-protector-all so that the canary code is emitted whatever the
default is. A target whose compiler has no stack protector at all cannot
do that, and on alpha the build stopped:
cc1: error: '-fstack-protector' not supported for this target [-Werror]
taking the rest of the elf tests with it. Guard the tests on $(have-ssp),
which configure already sets from the compiler's own answer. That is the
answer for -fstack-protector rather than for -fstack-protector-all, which
has its own configure test, but only the former reaches config.make, and a
compiler that has one has the other.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
alpha was the only target that overrode sysdeps/generic/nscd-types.h,
defining nscd_ssize_t as int64_t rather than int32_t. The file dated back
to the initial import and had only ever received licence and copyright
updates.
nscd's response headers are a wire format, shared between the daemon and
its clients through a socket and through the persistent cache. A 64-bit
nscd_ssize_t gives four of them 8-byte alignment while their last member is
32 bits, so they acquire four bytes of tail padding: hst_response_header,
ai_response_header, serv_response_header and innetgroup_response_header.
For the hosts cache that is fatal. cache_addhst() asserts that the string
data follows the header with no gap, and on alpha it does not:
nscd: hstcache.c:269: cache_addhst: Assertion
`(char *) (&dataset->resp.error + 1) == dataset->strdata' failed.
The daemon aborts, and nscd/tst-nscd-basic fails with 58 errors. With the
override removed it passes.
The padding is also never initialised. cache_addhst() assigns the header
fields individually and nothing clears the record, yet the response is sent
with writeall (fd, &dataset->resp, ...) covering the full
sizeof (hst_response_header), so four uninitialised bytes reach every
client.
With alpha gone there is no target left overriding the type, so the sysdeps
indirection has no purpose. Delete both headers and define nscd_ssize_t
directly in nscd/nscd-client.h alongside the wire format it describes.
This changes nscd's protocol and persistent cache layout on alpha; the
daemon and its clients always come from the same build, so the exposure is
a daemon left running or a cache file left behind across the upgrade.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
clang-23 enables -Wunused-but-set-global by default, which flags
variables that are set but never read. Also remove the fstat call,
which was only used to set the removed variable.
Two issues with clang-23:
1. -std=gnu11 triggers warnings with the 'uwb' suffix due to
-Wc23-extensions being enabled by default.
2. an ICE with __builtin_stdc_bit_ceil with a non-constant
unsigned _BitInt(1) argument [1]
This patch disables the warning for 1. and disables the affected
stdc_bit_ceil tests for clang.
[1] https://github.com/llvm/llvm-project/issues/214478
clang-23 warns that the variable 'ext' set but not used:
dl-cache.c:42:47: error: variable 'ext' set but not used
[-Werror,-Wunused-but-set-global]
The variable is set unconditionally by _dl_load_cache_lookup, but it
is only read by glibc_hwcaps_priorities_init (which is compiled only
for SHARED).
The test places the ancillary buffer so that it ends against a PROT_NONE
page, at cmsg - (CMSG_SPACE (tsize) + slack). CMSG_SPACE (sizeof (struct
timeval)) is a multiple of the alignment of struct cmsghdr, so the start of
the buffer inherits the alignment of the slack, and one of the slack sizes
the test uses is 4.
msg_control has to be suitably aligned for struct cmsghdr: recvmsg and the
CMSG_* macros both read cmsg_len from the start of the buffer, and it is a
size_t. On a target that does not fix up unaligned accesses in hardware,
reading it from a misaligned address traps into the kernel. On alpha each
one is reported:
ld-linux.so.2(48878): unaligned trap at 0000000120001e3c: ... 29 2
five per run, all from the loop over the control messages in
do_recvmsg_slack_ancillary. The test still passes, since the kernel
completes the access and returns.
Round the start of the buffer down to the alignment, and add the alignment
minus one to the requested allocation so the rounding cannot move the start
outside it. A slack that is not a multiple of the alignment then leaves the
buffer ending a few bytes short of the guard page rather than against it; the
overruns the guard page is there to catch are a whole timestamp rather than a
few bytes, so they are still caught.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
clang enables -Wsingle-bit-bitfield-constant-conversion with -Werror
and it triggers:
tunconf.c:338:32: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion]
338 | entry->value_is_negative = 1;
Change both value_is_negative and value_was_parsed to unsigned.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Change strace-tst-thp.sh to check the command exit status so that
unsupported THP tests exit with status 77.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
alpha was the only target implementing gethostname with the syscall
rather than through uname. Its only behavioural difference was the errno
for a too-small buffer: it reported EOVERFLOW where the generic
implementation, gethostname(2) and misc/tst-gethostname expect
ENAMETOOLONG, so alpha failed that test:
tst-gethostname.c:96: numeric comparison failure
left: 112 (0x70, EOVERFLOW); from: errno
right: 63 (0x3f); from: ENAMETOOLONG
The file contains nothing but that function, so removing it lets the
sysdeps search fall through to sysdeps/posix/gethostname.c, which
produces the same buffer contents and the expected errno.
misc/tst-gethostname passes on alpha with it.
Suggested-by: Florian Weimer <fw@deneb.enyo.de>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
glob splits the pattern at its rightmost slash and calls itself on
the part before it, so a pattern needs one stack frame per directory
component. It also calls itself once per brace expression. Either can
be made as deep as the pattern is long, so glob overflows the stack
before it can answer. The descent is on the pattern alone, so the
leading component, which is what decides whether anything can match at
all, is only reached at the bottom of the recursion:
glob ("__nonexistent__/*/*/.../*/x", 0, NULL, &g)
with a few thousand components crashes with an default stack (usually
8MB on Linux).
Expand the components in a loop instead. glob_dir_pattern collects
what each component has to do into a heap-allocated array, then matches
them from left to right, and glob_brace walks the brace expansions with
an explicit stack. Both arrays are sized from the pattern up front:
there is no more than one step per slash and no more than one brace
level per brace, since each consumes one.
Matching left to right also means a leading directory that does not
exist ends the expansion at the first component rather than after
descending through all of them.
Stack usage no longer depends on the pattern: a pattern with 100000
components now resolves on a 64 KiB thread stack, where before 4096
components overflowed 8 MiB.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
What is left are the name used to stat a component without
metacharacters and the blocks holding the matched names. With those on
the heap the alloca budget can go as well.
Also treat the size overflow as an error. It used to fall through
to malloc with the wrapped size and then copy the full length
into it.
alloca is now used only by the MSDOS and Windows paths, which glibc
does not build, so move its header out of the way as well.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
The last alloca in __glob is the buffer holding one expansion of a
brace expression. As with the directory and user names, the stack it
takes is not bounded by the call itself.
Use malloc unconditionally. __glob no longer uses alloca; glob_in_dir
still does, so the accounting stays for now.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
Use malloc unconditionally. The name is only needed for the passwd
lookup that follows, which is far more expensive than the allocation.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
Expanding "~" or "~user" needs a struct scratch_buffer to call
getpwnam_r through, where the code might reserve extra stack in
every glob frame (around 1224 bytes on x86_64). Even though the
lookups only run when the caller passed GLOB_TILDE or
GLOB_TILDE_CHECK.
Move the two lookups into glob_current_home_dir and glob_user_home_dir,
which return the directory as a malloc'ed string. The frame of each
glob call drops to around 184 bytes.
This also fixes a small leak: the ~user path returned GLOB_NOSPACE
without freeing user_name when scratch_buffer_grow failed.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
Use malloc unconditionally instead. These are one-off allocations
whose cost is dwarfed by the readdir and fnmatch work that follows.
The amount of stack this can take is not bounded by these calls alone,
glob recursively calls itself per pattern component, and each call
starts a fresh alloca budget.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
The nptl/tst-cancel32 test fails intermittently on LoongArch
with SIGSEGV at __longjmp:
0x7ffff7de7f6c <__longjmp+28> rotri.d $sp, $t0, 0x11
0x7ffff7de7f70 <__longjmp+32> xor $sp, $sp, $t1
rotri.d and xor are expanded from PTR_DEMANGLE2.
If the thread is cancelled between the rotri.d and xor,
an incomplete sp register causes the SIGSEGV.
Change the destination register of rotri.d to avoid an incomplete sp.
The 63b31c05a8 split relocation processing must agree for the lazy
flag, a mismatch would change the .rel.plt handling.
This is not an issue for any port currently, but on hppa it may return
a different value: if hppa implements IFUNC support, the second pass would
route PLT entries to its empty lazy handler and leave the descriptors
unrelocated, silently.
Make ELF_DYNAMIC_RELOCATE_PASS take lazy as an int lvalue and store the
effective mode back into it, so the DL_RELOC_IRELATIVE call reuses the
same variable instead of a separately threaded copy. The two passes can no
longer disagree about the partitioning. elf_machine_runtime_setup has side
effects, so it must stay a single call.
Checked on x86_64-linux-gnu, and built for all supported architectures.
Reviewed-by: Sam James <sam@gentoo.org>
Commit 63b31c05a8 ("elf: Defer all IRELATIVE relocations until after PLT
setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming
the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation
that may run an IFUNC resolver. That only holds for IFUNC symbols defined
in the object being relocated: a reference to an IFUNC in another object is
an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC
nature is only known after symbol resolution inside elf_machine_rel. Those
relocations stay in the regular pass, which no longer propagated
skip_ifunc, so __RTLD_NOIFUNC was ignored for them.
ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so
the resolver was called and the diagnostic emitted:
$ ldd -u /bin/ls
/bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk'
ldd -r with LD_BIND_NOW is affected in the same way.
Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC.
This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading
(it reads as "do not process IFUNC", yet it takes a skip_ifunc
argument). Replace it to:
DL_RELOC_BOTH -> DL_RELOC_ALL
DL_RELOC_NOIFUNC -> DL_RELOC_NORMAL
DL_RELOC_IFUNC -> DL_RELOC_IRELATIVE
ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single
ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and
ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three
near-identical variants each.
Checked on x86_64-linux-gnu, and built for all supported architectures.
Reviewed-by: Sam James <sam@gentoo.org>
Use $fail when we set it rather than just '1' (we already checked
that it is non-zero) to make logs more meaningful.
(Also, use $rc when we already checked it svalue.)
Rewrite the BZ#15339 test to use the resolv_test framework instead of
querying the network, so it can run as a regular test.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Commit 89b53077d2 ("nptl: Fix Race conditions in pthread cancellation
[BZ#12683]") added a second copy of the __INTERNAL_SYSCALL_NCS{0-7}
and INTERNAL_SYSCALL_NCS_CALL macros, which had already been defined
earlier in the same file by commit 00baddbb93 ("linux: Add generic
syscall implementation"). Remove the second copy.
Signed-off-by: Ryota Saito <saito.ryota.23@shizuoka.ac.jp>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
replacing realloc by reallocarray introduces a basic overflow check.
(old + count) might still overflow, but since the NSS backend is trusted,
we do not consider this to be a valid case.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The strcasecmp and strncasecmp tests repeatedly initialize large
buffers for many combinations of lengths and alignments. The existing
loops perform a remainder operation and call toupper and tolower for
every element.
Generate at most max_char elements using an additive recurrence and
apply the case conversions while creating this initial pattern. The
recurrence produces the same sequence as the existing multiplication
and remainder expression. Expand the completed pattern using bulk
copies.
This preserves the generated test data and locale-dependent case
conversion while substantially reducing the initialization cost on
slower systems.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The strcmp and strncmp tests repeatedly initialize large buffers for
many combinations of lengths and alignments. The existing loops
perform a remainder operation and two individual stores for every
element.
Generate at most max_char elements using an additive recurrence. The
recurrence produces the same sequence as the existing multiplication
and remainder expression. Expand this initial pattern using bulk
copies, and then copy the completed first buffer to the second buffer.
This preserves the generated test data while substantially reducing
the initialization cost on slower systems.
The change also applies to the wcscmp and wcsncmp tests, which include
the same test sources.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The librtld.map and librtld.os link recipes use $(gnulib), which on arm
contains libgcc-stubs.a through gnulib-arch. But the archive is only a
prerequisite of lib-noranlib so the rtld link can run before the archive
exists:
ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory
The race seems to predates the parallel subdirectory recursion, which
only made it observable.
Add the order-only dependency in sysdeps/arm/Makefile rather than in
elf/Makefile. Theprerequisite lists expand when the rule is parsed,
and gnulib-arch is only defined once Makerules includes the sysdeps
makefiles.
Verified with a build for arm-linux-gnueabihf.
Reviewed-by: Sam James <sam@gentoo.org>
The archive rules in Makerules list every stamp file as a prerequisite,
including the top level's own, and the elf sub-make evaluates them to
build libc_pic.a for the librtld.map link. A sub-make can only create
the stamp files of its own directory, so when the top-level ones do not
exist yet it fails with:
make[2]: *** No rule to make target '.../stamp.os', needed by
'.../libc_pic.a'. Stop.
The serial recursion created them before the subdirectories through the
prerequisite order of subdir_lib; the parallel recursion (commit
7cac99621e) does not. Add them as prerequisites of the object-building
per-subdirectory targets.
Reviewed-by: Sam James <sam@gentoo.org>
The %.d: %.dt rule seds its input into a fixed temporary name, renames
it into place and removes the input. Two makes converting the same
file trip over each other:
mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory
sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory
That happens because the elf rtld-Rules recursion runs a sub-make over
every $(rtld-subdirs) directory, which converts that directory's .dt
files, and the parallel subdirectory recursion (commit 7cac99621e)
runs it concurrently with those subdirectories' own sub-makes.
Add the PID of the shell to the temporary name and claim the input with
a rename: only the run that wins converts and installs the target.
Reviewed-by: Sam James <sam@gentoo.org>
The build-only first pass of the two-pass 'make check' still runs the
static checks (abi, conformtest, installed headers, etc.), and the
top-level tests recipe merged and summarized their results.
An unexpected FAIL there (e.g. check-abi) aborted 'check' before the
second pass ran any built test, and even a clean run printed a misleading
partial summary.
Pass tests-summary=no in the first pass to skip the merge and summary;
the .test-result files persist, so the second pass folds those results
into the one complete summary at the end, restoring the single-pass
reporting behavior.
Reviewed-by: Sam James <sam@gentoo.org>
The $(inst_includedir)/%.h install rules exist only where $(headers) is
non-empty, so in a subdir without headers (e.g. csu) the prerequisite
added on install-others-nosubdir has no rule.
It only worked because .NOTPARALLEL made the top level install the header
first, which the parallel subdir recursion no longer guarantees.
Reviewed-by: Sam James <sam@gentoo.org>
The parallel subdirectory recursion (commit 7cac99621e) only orders
csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges
the Depend files request. A header generated from gen-as-const-headers
is only ordered before the compilations of the subdirectory that
adds the .sym (through before-compile), so a header consumed by a
different subdirectory may not exist yet when its consumer is
compiled.
That is the case for <sigaltstack-offsets.h>: it is generated when
building misc, while its only consumer, ____longjmp_chk.S (x86_64 and
sh), is built in debug. The serial recursion always ran misc before
debug in the sorted order, hiding the missing dependency.
Move the generate the header to 'debug' instead.
The same class of problem exists on Hurd: jmp_buf-ssp.h that is used
by ____longjmp_chk.S in debug, and signal-defines.h that is sued
by debug and setjmp.
Deterministically reproduced with 'make debug/subdir_lib' from a clean
build tree (which orders only csu before debug), and verified with
builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu.
Reviewed-by: Sam James <sam@gentoo.org>
_Float32x and _Float64 are both binary64 on Alpha, so this narrowing
divide is a plain divide and the hardware alone decides whether to signal
underflow.
IEEE 754 determines tininess after rounding from the result rounded as if
the exponent range were unbounded, while Alpha determines it from the
delivered result. The two differ for a quotient that is tiny but rounds
up to the smallest normal, as in DBL_MIN / (1 + 2^-52) under a rounding
mode that rounds away from zero: the binade below DBL_MIN has a finer
spacing than the subnormals, so the unbounded rounding stays below
DBL_MIN and the result is tiny, but the delivered result is DBL_MIN and
looks normal. Alpha signals no underflow for it.
Nothing in software can correct this. The hardware detects no underflow,
so no software completion trap is taken and the kernel emulation never
runs, and as the operation is not really narrowing there is no wider
intermediate for libm to examine.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
FE_NOMASK_ENV is the floating-point environment in which no exception is
masked, so it must enable every exception that FE_ALL_EXCEPT covers. On
Alpha that includes the GNU extension FE_DENORMAL, whose SWCR trap enable
bit is IEEE_TRAP_ENABLE_DNO (bit 6).
The constant only set bits 1 through 5 (INV, DZE, OVF, UNF and INE), so
after fesetenv (FE_NOMASK_ENV) a subsequent fegetexcept () returned
0x3e0000 rather than FE_ALL_EXCEPT (0x7e0000), and denormal exceptions
stayed masked. Set bit 6 as well.
Fixes math/test-fenv-return on alpha.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The cancellable syscall wrappers end with a tail call to __syscall_cancel,
the wrapper frame is then elided, so when the syscall executes the wrapper
is no longer present on the stack. Tools that unwind from CFI alone, such
as valgrind, perf and sampling profilers, cannot observe it. On gdb, it
only recovers it from DWARF call site information, which reduced-debuginfo
libc builds usually omit.
The behaviour is target dependent: for a shared (PIC) the tail call is
emitted on aarch64, arc, loongarch and riscv. It is not emitted on i386,
x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed
on the stack or fewer argument registers are available, nor on powerpc
and mips, where the TOC/GOT pointer must be restored after the call.
This is why the problem was originally reported as aarch64 specific while
x86_64 was unaffected.
Rather than only inhibiting the tail call [1] (which keeps the wrapper frame
but still leaves the __syscall_cancel and __internal_syscall_cancel
frames), move the cancellation logic back into the wrappers. In the
single-threaded case the syscall is now issued directly from the wrapper;
only the multi-threaded path still calls the out-of-line __syscall_cancel_arch.
This keeps the wrapper observable and removes the extra frames, mimicking
how cancellation was handled before 89b53077d2.
The result is a small libc.so .text increase (size, first column):
ABI master patched diff increase
aarch64 1635880 1647424 11544 0.71%
x86_64 1981081 1992257 11176 0.56%
powerpc64le 2364336 2376964 12628 0.53%
riscv64 1368386 1376704 8318 0.61%
loongarch64 1741385 1755601 14216 0.82%
The tst-backtrace5 was suppose to track this issue, but due wrong
loop variable check it does not take this in account. This patch also fixes
it.
Checked on aarch64-linux-gnu, x86_64-linux-gnu, i686-linux-gnu,
arm-linux-gnueabihf, and powerpc64le-linux-gnu.
[1] https://sourceware.org/pipermail/libc-alpha/2025-March/165395.html
Whether the value is an infinity, a NaN or zero does not change between
the conversions applied to it, but was determined again for each one.
Determine it where the value is read.
Also look for the '#' flag with index() before matching the expressions
that need it, and test the value first where both have to hold.
For the %f conversion for double, in the C locale, as the median of five
runs:
x86_64, gawk 5.4.1 1.248s -> 1.184s
x86_64, gawk 5.3.2 0.703s -> 0.708s
alpha, gawk 5.4.60 26.6s -> 25.8s
So this only helps with the regular expression engine that gawk 5.4
brought in; under 5.3.2 it is lost in the noise. Output and exit status
are unchanged for the e, f and g conversions for double under both
gawk versions and both locales.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The program under test runs in the C locale, through the test program
prefix, but AWK inherits whatever locale the build was started in. They
agree today only because the locale in use shares its decimal point with
the C locale.
It is also faster. gawk takes a single byte path in its regular
expression engine when MB_CUR_MAX is 1, and the script matches several
expressions against every line. For the %f conversion for double, the
largest of these tests, as the median of five runs:
x86_64, gawk 5.4.1 1.482s -> 1.248s
x86_64, gawk 5.3.2 0.911s -> 0.703s
alpha, gawk 5.4.60 30.9s -> 26.6s
Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at
1.248s against 0.703s for the same input in the C locale, so these tests
have become more expensive than they used to be.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The check for -mlong-double-128 IBM extended format support wrapped its
test code in AC_LANG_PROGRAM, which places the body inside main(). The
body defines a function, so it became a nested function definition -- a
GCC extension that Clang does not implement, making the test fail with
Clang.
Use AC_LANG_SOURCE so the function is defined at file scope, and
regenerate configure.
Reviewed-by: Sam James <sam@gentoo.org>
The check for -mlong-double-128 support wrapped its test code in
AC_LANG_PROGRAM, which places the body inside main(). The body defines
a function, so it became a nested function definition -- a GCC extension
that Clang does not implement, making the test fail (and thus the whole
build error out) with Clang even though it supports -mlong-double-128.
Use AC_LANG_SOURCE so the function is defined at file scope, matching the
pattern already used by the powerpc64le compiler checks, and regenerate
configure.
Reviewed-by: Sam James <sam@gentoo.org>
Improve the error diagnostics printed when static TLS allocation fails
during dlopen.
The CHECK_STATIC_TLS macro is updated to pass the fully resolved sym and
the referencing map over to _dl_allocate_static_tls, modifying its
signature.
When _dl_allocate_static_tls is called, it now attempts to reconstruct
what failed using _dl_exception_create_format. It displays:
* The name of the symbol that triggers this.
* Whether this is due to static TLS space being exhausted, or if the
symbol has previously been used as global-dynamic and is now being
tried to use as initial-exec.
* If the symbol-defining map is different from the referencing map, it
includes its name as well.
* If static TLS is exhausted, includes requested size and available
size.
The change cascades through all architecture variants modifying their
dl-machine calls to CHECK_STATIC_TLS to conform to the new prototype.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Commit 6758def717 changed the generic ftw{64}.c to include
kernel_stat.h, which is Linux specific.
Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0,
since struct stat and struct stat64 never share a layout on Hurd: on
32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat,
and on 64-bit ABIs the two structures still differ in size because
_SPARE_SIZE in bits/stat.h reserves three more ints of spare space in
struct stat than in struct stat64.
This keeps the ftw/ftw64 symbols exactly as before the change, where
the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because
the Hurd bits/typesizes.h does not define it.
Checked with a full build for i686-gnu and x86_64-gnu.
If a clock doesn't have enough precision to check the sleep resolution
(quantum.tv_nsec > TEST_NSEC / 10) then record the quantum.tv_nsec,
but skip the interval_test and abs_test for that clock.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
The Alpha ABI requires the stack pointer to be 16-byte aligned.
However, __makecontext did not realign it after reserving space for
arguments. Depending on uc_stack.ss_size, this could leave the stack
only 8-byte aligned.
Round the new stack pointer down to a 16-byte boundary after reserving
the argument area.
This fixes stdlib/tst-makecontext2.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
On MIPS n64 off_t is same as off64_t, but struct stat is not same as
struct stat64 (very peculiar but see the "as tempting as it..." comment
in linux/mips/kernel_stat.h). As the ftw/ftw64 callback accepts a
pointer to a function who accepts struct stat/stat64, for MIPS n64 we
must use different implementations for ftw and ftw64.
Thus for testing if ftw64 can be aliased to ftw, we should check
XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T.
This resolves the io/tst-ftw-lnk failure observed on MIPS n64.
Link: https://sourceware.org/glibc/wiki/Testing/Tests/io/tst-ftw-lnk
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The generic implementation emits libm_alias_double unconditionally, so
tanhf32x and tanhf64 bind directly to __tanh_fma.
Guard the alias with '#ifndef __tanh' and emit it from the dispatcher,
as sin. Also remove the stale __expm1 defines, unused since tanh moved
to CORE-MATH.
Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'.
Reported-by: Michael Brunnbauer <brunni@netestate.de>
Commit b52619f2e8 added a new dlinfo
request type, RTLD_DI_ORIGIN_PATH, to be used instead of RTLD_DI_ORIGIN
which is prone to buffer overflows. With a replacement available,
RTLD_DI_ORIGIN can now be deprecated.
This commit deprecates RTLD_DI_ORIGIN by adding a compile-time warning
upon its use, and documents the deprecation in the manual.
The warning depends on "Enumerator Attributes" supported by gcc
since 6.1 and by clang. A new macro __attribute_deprecated_enum__,
analogous to __attribute_deprecated_msg__, is defined in cdefs.h.
Because gnulib can override system-installed cdefs.h, thus hiding our
definition, the deprecation is conditional on the macro being defined.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The $(objpfx)bench-%.c rule writes its output into $(objpfx) without
ensuring that directory exists. Serial builds happened to satisfy
that ordering, with parallel builds the generation recipe can
run before the directory is created, failing with:
cannot create .../benchtests/bench-xxx.c-tmp: Directory nonexistent
Add the standard $(make-target-directory).
Reviewed-by: Florian Weimer <fweimer@redhat.com>
When compiling a glibc for a merged-/usr distro people may set
rootsbindir=/usr/sbin. But tst-ldconfig-cache has hard-coded
/sbin/ldconfig path and so it fails with a different rootsbindir.
Fix it by using support_install_rootsbindir like run_ldconfig in
test-container.c.
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Add locale data for Brahui (brh), a Dravidian language spoken by
approximately 2.8 million people (2023 Pakistan Census) primarily in
Balochistan, Pakistan. Brahui is the only Dravidian language written
in the Perso-Arabic (Nastaliq) script.
The ISO 639-3 code brh is added to iso-639.def. Brahui has no ISO
639-1 or ISO 639-2 code, so the three-letter code is used for both the
terminology and bibliographic fields, as is already done for other
639-3-only entries such as brx (Bodo).
Locale content follows CLDR locale brh, for which the submitter is the
contributing native speaker.
Changes since v3:
- iso-639.def: place Brahui before Braj, restoring alphabetical
order by English language name.
- LC_TIME: add first_weekday 1 and first_workday 2. The previous
value of 7 selected Saturday, which does not match CLDR territory
data for PK (firstDay = sun); ur_PK and sd_PK both use 1.
- LC_TIME: reorder d_t_fmt and date_fmt so the date precedes the
time, matching the CLDR brh date-time combination pattern and the
shape used by sd_PK, and use U+060C ARABIC COMMA as the separator,
which is the comma in the CLDR brh punctuation exemplar set.
- LC_TIME: abday repeats the full day names, as Brahui has no
distinct abbreviated forms; CLDR brh gives identical values at the
abbreviated and wide widths, and ur_PK, pa_PK and fa_IR do the
same.
- LC_TIME: am_pm now matches the CLDR brh day-period values.
- LC_MONETARY: n_sep_by_space 1, matching p_sep_by_space, so that
positive and negative amounts are spaced alike.
- LC_MESSAGES: yesexpr accepts U+062C and U+0647, and noexpr accepts
U+0627, since these initials occur in attested spellings of the
affirmative and negative words.
- LC_CTYPE: add transliterations for U+06C1 and U+06B7.
- LC_TELEPHONE: use the "+%c %a %l" form.
- LC_IDENTIFICATION: record CLDR as the source; bump revision.
Signed-off-by: Hammad Mengal <hammadalo99@gmail.com>
Reviewed-by: Mike FABIAN <mfabian@redhat.com>
The CORE-MATH import mistranslated the accurate path result scaling
'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed6), and two of
the 51 exceptional-case table entries were dropped when the table was
moved to e_sinh_data.c (commit f05c4907a2).
Checked on x86_64-linux-gnu and aarch64-linux-gnu.
Remove the glibc.cpu.name tunable since it's unused and out of date.
Add support for glibc.cpu.hwcaps to adjust ifunc selection for debugging
and benchmarking. Only allow disabling of features that are (a) used by
ifuncs, (b) safe to disable to a more generic ifunc without any security
impact.
Reviewed-by: Yury Khrustalev <yury.khrustalev@arm.com>
posix says value being 0 means disabling a timer, regardless of the
interval, so we should clear the interval in that case, so a further
setitimer call does not see a non-zero interval.
This avoids spurious xaccept errors on slow systems. With this
change, the test still reproduces the original bug.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
The thread state structure requires plain pointers, while the jmpbuf has
mangled pointers.
Fixes 78f1f0e39c
("Consolidate the C pointer guard and align the assembly
implementations")
The Payne-Hanek range reducer __branred delivers the reduced argument
as a double-double with only about 93 significant bits. For arguments
extremely close to a multiple of pi/2 the true reduced argument can be
as small as 2^-61, so most of those bits cancel and sin/cos/tan can be
wrong by up to ~143000 ulp. This inaccuracy used to be handled by the
multiple-precision slow paths, which was removed by commit
649095838b ("sin/cos slow paths: remove slow paths from huge range
reduction") and commit 476d692e8a ("math: Remove slow paths in tan
[BZ #15267]").
Restore the e_rem_pio2.c (removed as unused by commit ca3aac57ef
"Remove unused math files") and use __ieee754_rem_pio2 for
the huge-argument reduction instead of __branred, which is removed.
It also does not depend on precise IEEE double rounding, so the nofma
and vector-width workarounds for branred.c are no longer needed.
The file is restored trimmed to its huge-argument path, the callers
reduce smaller arguments themselves and handle non-finite inputs, so
only 1e8 < |x| < 2^1024 reaches __ieee754_rem_pio2.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, armv7a-linux-gnueabihf,
and i686-linux-gnu.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
The tan input list spans the full binary64 range, so a single number mixes
the kernel, and the i__branred reductions in one average. Add two named
workloads that isolate the ends of that spread, so each can be measured
separately:
- workload-fast.wrf: uniform random inputs in [-pi, pi].
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
The sin input list spans the full binary64 range, so a single number mixes
the kernel, the reduce_sincos reduction , and the __branred reduction in
one average. Add three named workloads that isolate the paths __cos
actually dispatches to, so each can be measured separately:
- workload-fast.wrf: uniform random inputs in [-pi, pi].
- workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades.
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
Reviewed-by: Carlos O'Donell <carlos@redaht.com>
The cos input list spans the full binary64 range, so a single number mixes
the kernel, the reduce_sincos reduction , and the __branred reduction in one
average. Add three named workloads that isolate the paths __cos actually
dispatches to, so each can be measured separately:
- workload-fast.wrf: uniform random inputs in [0, 2*pi].
- workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades.
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
The sparc64 uses an 8KB base page and 8MB PMD transparent huge page.
It fixes the following regression on sparc:
FAIL: elf/tst-thp-1
FAIL: elf/tst-thp-1-no-s-code
FAIL: elf/tst-thp-1-no-s-code-pde
FAIL: elf/tst-thp-1-no-s-code-static
FAIL: elf/tst-thp-1-pde
FAIL: elf/tst-thp-1-static
FAIL: elf/tst-thp-align
Checked with the elf tests on qemu sparc64.
Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
The split introduced by commit 63b31c05a8 does not handle sparc
and (R_SPARC_JMP_IREL) powerpc64 (ELFv1, R_PPC64_JMP_IREL), which
are emited in some constructions. Handle such cases on
elf_dynamic_is_Rel_irelative.
It fixes elf/tst-ifunc-fault-bindnow and elf/tst-ifunc-fault-lazy on
sparc64 (powerpc64 emits R_PPC64_IRELATIVE in both cases,
R_PPC64_JMP_IREL is emitted only when the ifunc is called, not just
referenced).
Checked with the elf tests on qemu sparc64 and powerpc64.
Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
After commit b75ad99d45, __libc_setup_tls -> _dl_allocate_tls_init copies
the TLS init image with the IFUNC __mempcpy before ARCH_SETUP_IREL resolves
it, so on a multi-arch sparcv9/sparc64 static build the call jumps through an
unrelocated PLT slot and the process dies with SIGILL.
The sparc dl-symbol-redir-ifunc.h only redirected memset. Redirect
memcpy, memmove, mempcpy and __mempcpy to the ultra1 routines as well,
and merge the identical sparc64 and sparc32/sparcv9 copies into a single
sysdeps/sparc file. The redirection is guarded by __sparc_v9__ &&
USE_MULTIARCH so that sparcv8 (leon) and --disable-multi-arch builds,
which have no __*_ultra1 routines, are left untouched.
Checked with elf tests for sparc32 and sparc64 on qemu system.
Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
Since DL_MAP_DEFAULT_THP_PAGESIZE is defined for x86-64, THP control
is to set to madvise by default. If THP is disabled in x86-64 kernel,
madvise (..., MADV_HUGEPAGE) returns -EINVAL to indicate that THP isn't
supported. Add _dl_thp_madvise to disable THP in this case. This
fixes BZ #34348.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
LOAD-THP-ADDRESS-LDFLAGS was added to work around:
https://sourceware.org/bugzilla/show_bug.cgi?id=34184
which is needed for THP PDE tests. Add $(LOAD-THP-ADDRESS-LDFLAGS) to
LDFLAGS-tst-thp-1 and LDFLAGS-tst-thp-1-no-s-code if PIE isn't built
by default so that they are linked with $(LOAD-THP-ADDRESS-LDFLAGS).
This fixes BZ #34314.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
The previous implementation saved a copy of the wordexp_t struct at
entry and blindly restored it on error via (*pwordexp = old_word).
This is incorrect when WRDE_APPEND is set because w_addword may have
called realloc on we_wordv during partial processing before the error
was detected. If realloc relocated the buffer, the saved we_wordv
pointer is dangling; restoring it causes a use-after-free in the
caller (e.g. via wordfree), and the relocated buffer is leaked.
Fix this by duplicating the we_wordv pointer array at entry when
WRDE_APPEND is set, so that all subsequent realloc calls inside
w_addword operate on the copy.
This change also fixes a POSIX conformance issue: if the WRDE_APPEND
flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
not be modified.
Also fix two pre-existing error return paths in the '"' and '\'' cases
that returned directly from w_addword failures instead of going through
do_error, which would leak the saved array (and previously would also
skip the word cleanup).
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
Add --install option, which copies a pre-built ld.so.cache into place,
honoring the cache and root options and defaults. This gives the user
a canonical "correct" way to install a pre-built cache without risk
of a program trying to load a partially-written file.
Co-authored-by: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
At the time the s390-32 strncpy implementation was adjusted for the
s390-64 port, the brct (branch relative on count) instruction was
not adjusted from 32bit to 64bit instruction.
If n contains a value >32bit, the number of 8 byte chunks is computed
with srlg (64bit shift right). The processing of 8 byte chunks is then
processed by looping with brct (32bit branch relative on count) instruction.
This patch just uses the brctg (64bit branch relative on count) instruciton.
Note 1: There is a second loop copying the remaining seven bytes. The usage
of 32bit brct for looping is fine here.
Note 2: If glibc is build with architecture level set >=z13, the z900 variant
of strncpy is not build at all.
Note 3: If glibc is build for <z13, the z900 ifunc variant is only chosen if
not run on >=z13 or if called via __GI_strncpy.
On s390x the test elf/tunconf1 fails with:
tst-tunconf1.c:41: numeric comparison failure (widths 64 and 32)
left: 180388626436 (0x2a00000004); from: (long)perturb
right: 42 (0x2a); from: 42
According to elf/dl-tunables.list, glibc.malloc.perturb is of type int32_t (4byte)
and not size_t (8byte) which was used for TUNABLE_GET_FULL inside the testcase.
Therefore the correct 32bit value 0x2a=42 is written to the to the wrong place
and leads to the comparison failure.
The printf format specifiers for size_t were also adjusted.
Reviewed-by: DJ Delorie <dj@redhat.com>
The unconditional '.NOTPARALLEL' in benchtests/Makefile forced the whole
subdirectory to build serially, even though its only purpose is to keep
the benchmark *runs* from perturbing each other's timing.
Replace it with ordering that serializes only the benchmark runs, and
only when more than one benchmark group will actually run. The combined
'bench' goal builds every benchmark program in parallel (through
bench-build) and then runs the bench-set, bench-func and bench-malloc
groups strictly one after another.
Reviewed-by: Sam James <sam@gentoo.org>
For the default --enable-default-pie, $(pic-default) adds -DPIC to
CPPFLAGS-.o so. However, -fPIE ($(pie-default)) is only added to
CFLAGS-.o, which does not affect assembler (.S) sources
On SPARC the GOT register setup in SETUP_PIC_REG references
_GLOBAL_OFFSET_TABLE_ through %hi/%lo, and the assembler only rewrite
those into the required PC-relative relocations (R_SPARC_PC22 and
R_SPARC_PC10) when it is in *PIC* mode; otherwise it emits absolute
R_SPARC_HI22/R_SPARC_LO10. With the absolute relocations the
__sparc_get_pc_thunk sequence adds the run-time PC to an already-absolute
GOT address, so the computed GOT register is wrong. In _start this makes
the address of main come out bogus, and __libc_start_main jumps to an
unmapped address.
This removes the requirement of the --disable-default-pie for sparc
to build static binaries correctly.
Checked some tests (mainly the elf/ one) on a sparc64-linux-gnu
qemu system.
Reviewed-by: Sam James <sam@gentoo.org>
The per-tunable security level is no longer part of struct _tunable and
no tunable in dl-tunables.list declares one.
Reviewed-by: DJ Delorie <dj@redhat.com>
A system-wide tunable without an onlysecure/nonsecure/anysecure prefix
defaults to "nonsecure", i.e. it is not applied to AT_SECURE processes.
This is a deliberate, conservative default but was not documented.
Reviewed-by: DJ Delorie <dj@redhat.com>
The environment-variable alias loop in __tunables_init skipped every tunable
whose "initialized" flag was set, which was originally meant only to give
the canonical GLIBC_TUNABLES form precedence over the legacy MALLOC_*
aliases.
Now that the cache also sets "initialized", a legacy alias could no longer
override an *overridable* cache default, even though the canonical
GLIBC_TUNABLES form still could.
Track separately the tunables that were set from GLIBC_TUNABLES during this
call and skip only those in the alias loop
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
_dl_check_ldsocache_needs_loading only stored the stat fields it
compares (mtime, ino, size, dev) on the path where a cache was already
loaded. On the very first call CACHE is NULL and the function returned
"needs loading" without recording those fields, leaving
new_cache_file_time zero. The next call then copied that zero value
into cache_file_time and compared it against the freshly stat'd values,
which always differed, forcing a second, unnecessary load (munmap +
mmap + re-parse) of an unchanged cache at every startup.
It can be shown with repro:
$ cat << EOF > repro.c
#include <dlfcn.h>
int main (void) { dlopen ("does-not-exist-xyz.so.99", RTLD_NOW); return 0; }
EOF
$ gcc repro.c -o repro
$ strace -f -e trace=openat elf/ld.so --library-path . ./repro 2>&1 | grep -c "/etc/ld.so.cache"
The result should be 1, instead of 2.
Record the stat fields as soon as the stat succeeds, before the
CACHE == NULL early return, so the following call has an accurate
baseline and does not spuriously reload.
Reviewed-by: DJ Delorie <dj@redhat.com>
The tunable header signature and version are written by ldconfig but
never checked them on read, so the version field was inert. Reject
the section unless both match.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
_dl_load_cache_tunables bounds each entry's string offsets against
[s_start, start + cache_new->len_strings], but len_strings is an
unvalidated 32-bit field from ld.so.cache and s_start/s_end were int. A
corrupt cache with an oversized len_strings could make s_end exceed the
mapping (or overflow), letting an offset point outside the mmap; the
following strcmp/__strdup would then read unmapped memory.
Compute the offsets as size_t and clamp s_end to cachesize, matching how
the regular library lookup bounds string offsets against the mapping size.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
There is no cross-directory exclusion of concurrent $(gen-locales)
usage. Parallel localedef calls can clobber locale data as it is
being loaded by tests.
With the separate staging areas, there are no peer directories,
so hard-linking no longer happens. The touch command is therefore
unnecessary.
Reviewed-by: Sam James <sam@gentoo.org>
Add the TCP_RTO_MAX_MS and TCP_RTO_MIN_US socket options (commit
54a378f43425085d0684679d99735696b69165bc, Linux 6.15) and TCP_DELACK_MAX_US
(commit 9552f90835ef3552d0af327e48dc360717777d62, Linux 6.15).
Commit 7e46c2aae4 synced the accurate ECN
additions but encoded the trailing bitfield word of struct tcp_info
incorrectly as two uint16_t fields (tcpi_accecn_fail_mode and
tcpi_accecn_opt_seen), omitting tcpi_ecn_mode and tcpi_options2. Restore
the kernel layout:
uint32_t tcpi_ecn_mode:2,
tcpi_accecn_opt_seen:2,
tcpi_accecn_fail_mode:4,
tcpi_options2:24;
The overall structure size is unchanged. Also add the TCPI_ECN_MODE_*
and TCP_ACCECN_* value constants for these fields, introduced together
with them by Linux commit 4fa4ac5e5848 (Linux 7.0).
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Add OPEN_TREE_NAMESPACE (commit 9b8a0ba68246a61d903ce62c35c303b1501df28b,
Linux 7.0) and FSMOUNT_NAMESPACE (commit
5e8969bd192712419aae511dd5ba26855c2c78db, Linux 7.1).
THREAD_SET_STACK_GUARD reads the thread pointer via THREAD_SELF
(__builtin_thread_pointer), which the compiler treats as invariant. In the
static startup path the thread pointer is installed by the __libc_setup_tls
call that immediately precedes the guard store, so the read must stay below
it. The existing barrier only clobbered the access registers a0/a1, which
creates no dependency on the call, so the compiler could move the whole
barrier and read above __libc_setup_tls.
This is sensitive to instruction scheduling and recent TLS startup
changes exposed it on s390x.
Add a "memory" clobber to the barrier so it is tied to the call's memory
effects and cannot be hoisted above it. The macro is shared with the
dynamic loader, so both startup paths are covered.
I checked on s390x-linux-gnu build for arch5, arch8, arch9, and arch11
by running the elf tests on qemu system (kernel 6.1.0).
Reviewed-by: Stefan Liebler <stli@linux.ibm.com>
commit 7cac99621e
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Wed Jun 10 16:26:15 2026 -0300
Makefile: Run the subdirectory recursion in parallel
added:
$(elf-objpfx)ld.so $(elf-objpfx)sofini.os $(elf-objpfx)interp.os: \
| elf/subdir_lib ;
which doesn't work with
$ make check -jN subdirs=DIR
where DIR doesn't have elf. Add such rule only if $(subdirs) has elf.
This fixes BZ #34355.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
This patch adds an RVV-optimized implementation of strncpy for RISC-V and
enables it for both multiarch (IFUNC) and non-multiarch builds.
The implementation integrates Hau Hsu's 2023 RVV work under a unified
ifunc-based framework. A vectorized version (__strncpy_vector) is added
alongside the generic fallback (__strncpy_generic). The runtime resolver
selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector
support (RVV).
Currently, the resolver still selects the RVV variant even when the RVV
extension is disabled via prctl(). As a consequence, any process that
has RVV disabled via prctl() will receive SIGILL when calling strncpy().
Co-authored-by: Hau Hsu <hau.hsu@sifive.com>
Co-authored-by: Jerry Shih <jerry.shih@sifive.com>
Signed-off-by: Yao Zihong <zihong.plct@isrc.iscas.ac.cn>
Reviewed-by: Peter Bergner <bergner@tenstorrent.com>
This patch adds an RVV-optimized implementation of stpncpy for RISC-V and
enables it for both multiarch (IFUNC) and non-multiarch builds.
The implementation integrates Hau Hsu's 2023 RVV work under a unified
ifunc-based framework. A vectorized version (__stpncpy_vector) is added
alongside the generic fallback (__stpncpy_generic). The runtime resolver
selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector
support (RVV).
Currently, the resolver still selects the RVV variant even when the RVV
extension is disabled via prctl(). As a consequence, any process that
has RVV disabled via prctl() will receive SIGILL when calling stpncpy().
Co-authored-by: Hau Hsu <hau.hsu@sifive.com>
Co-authored-by: Jerry Shih <jerry.shih@sifive.com>
Signed-off-by: Yao Zihong <zihong.plct@isrc.iscas.ac.cn>
Reviewed-by: Peter Bergner <bergner@tenstorrent.com>
After
7cac99621e Makefile: Run the subdirectory recursion in parallel
tests under elf may run in parallel. "make check -jN" reports
FAIL: elf/strace-tst-thp-align-default
FAIL: elf/strace-tst-thp-align-disabled
FAIL: elf/strace-tst-thp-align-enabled
at random since they use tst-thp-align which dlopens tst-thp-size-mod.so,
but tst-thp-size-mod.so dependency is missing. Add the missing dependency
to fix BZ #34351.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
There are no new constants covered by tst-mman-consts.py or
tst-openat2-consts.py in Linux 6.18, 6.19, 7.0, or 7.1.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Linux 6.18 adds the uprobe syscall (x86_64 only), Linux 6.19 adds listns,
and Linux 7.0 adds rseq_slice_yield. Linux 7.0 also wires up clone3 on
sparc and memfd_secret on loongarch. Update syscall-names.list and
regenerate the arch-syscall.h headers with build-many-glibcs.py
update-syscalls.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
It was added by commit 2e7af192697ef2a71c76fd57860b0fcd02754e14, which
introduced the flags argument for sched_getattr.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The pidfd_info interface was extended to report coredump information:
* PIDFD_INFO_SUPPORTED_MASK, along with the supported_mask field, so
userspace can check which flags the running kernel supports (commit
dfd78546c95330db2252e0d7e937a15ab5eddb4e, Linux 6.19).
* PIDFD_INFO_COREDUMP_SIGNAL, along with the coredump_signal field
(commit 036375522be8425874e9e0f907c7127e315c7a52, Linux 6.19).
* PIDFD_INFO_COREDUMP_CODE, along with the coredump_code field (commit
701f7f4fbabbf4989ba6fbf033b160dd943221d5, Linux 7.1).
The struct pidfd_info is extended accordingly and PIDFD_INFO_SIZE_VER1,
PIDFD_INFO_SIZE_VER2, and PIDFD_INFO_SIZE_VER3 are added to reflect the
new struct sizes.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Add the FD_NSFS_ROOT (commit e83f0b5d10dcf62833008327cb661c7d118bca85,
Linux 6.18), and F_GETDELEG and F_SETDELEG (commit
1602bad16d7df82faca6d7c70821117684a66f49, Linux 6.19).
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The VZEROUPPER_SHORT_RETURN macro in memset-vec-unaligned-erms.S has had
no users since commit e59ced2384 ("x86: Optimize
memset-vec-unaligned-erms.S") removed its last invocation, leaving both
the VEC_SIZE > 16 definition and the "rep; ret" fallback definition in
place. Remove the two now-dead definitions.
Signed-off-by: RyotaSaito <saito.ryota.23@shizuoka.ac.jp>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Assign the realloc result to a temporary variable, so the original
memory block is not lost if the allocation fails.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The tests-container rule launches support/test-container, which is always
dynamically linked, through $(test-via-rtld-prefix). That prefix is empty
for tests listed in tests-static/xtests-static, so for a static container
test the helper ran under the system loader/libc instead of the newly
built one.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
The default 'make check' serializes the timing-sensitive test runs: the
threading (nptl, or htl on Hurd) and realtime (rt) subdirectories run
with .NOTPARALLEL and are ordered after the rest of the test run, so they
are not perturbed by competing machine load.
Add a check-parallel (and xcheck-parallel) variant for when that is not
wanted -- an idle machine, or a run where the extra throughput is worth
the risk of flakiness in the timing-sensitive tests (check the
libc-alpha discussion [1] for more context why this approach was proposed).
A new serialize-tests flag (default yes, defined in Makeconfig) gates both
the per-subdirectory .NOTPARALLEL and the top-level run-time ordering;
check-parallel just runs the suite with serialize-tests=no, so every test
program builds and runs at full concurrency in a single pass.
'make check' and its default behavior are unchanged.
[1] https://inbox.sourceware.org/libc-alpha/lhutsr3khz7.fsf@oldenburg.str.redhat.com/
Reviewed-by: Sam James <sam@gentoo.org>
The check-installed-headers-c/-cxx tests ran one script invocation per
subdirectory over all of its installed headers, performing about 80
compiler invocations per header serially.
Give each header its own intermediate target so the compiler
invocations parallelize under the make jobserver, recording the
per-header script exit status next to the output. The .out target
concatenates the per-header outputs in the original $(headers) order
and fails if any recorded status is non-zero, so both the .out contents
(verified byte-identical for all 76 files) and the tests.sum results
are unchanged.
Results on a x86_64 machine [1] from a make check with run-built-tests=no
show neutral results, and on aarch64 machine [2] it improves from 241.574s
to 182.405.
[1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3
[2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3
Reviewed-by: Sam James <sam@gentoo.org>
Every subdirectory tests target depends on
$(objpfx)testroot.pristine/install.stamp, whose recipe performs a full
DESTDIR installation (about 12s and 154MB on x86_64). The testroot is
only consumed by the container tests, which do not run when
run-built-tests is no, so skip it entirely in that case.
This saves about 10s on x86_64 [1] and 30s on aarch64 [2].
[1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3
[2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3
Reviewed-by: Sam James <sam@gentoo.org>
The requirement that the elf subdirectory comes last in the
subdirectory ordering stems from its lib pass: the rtld link consumes
$(common-objpfx)libc_pic.a, which aggregates every other
subdirectory's objects.
The others, tests, and xtests classes have no such dependency: everything
they consume from other subdirectories is provided by the pass barriers
(others after lib, tests after others). Keep elf last only for the
object-building classes and let its others and tests sub-makes run
concurrently with the other subdirectories.
With elf no longer forced last for those classes, the Depend edges
pointing to elf (e.g. support/Depend) no longer create a cycle there,
so honor them instead of dropping them.
This improves the make check with run-built-tests=no, specially on
machine with many cores. Results on a x86_64 machine [1] it improves
from 190s to 181s, while on a aarch64 machine [2] it improves from
298.726s to 243.098s.
Build results remain bit-identical and the tests.sum failure sets are
unchanged.
[1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3
[2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3
Reviewed-by: Sam James <sam@gentoo.org>
The top-level makefile was marked .NOTPARALLEL and ran the
per-subdirectory sub-makes strictly one at a time in the topological
order computed by scripts/gen-sorted.awk. Only the compilations inside
a single subdirectory could run in parallel, so on wide machines every
subdirectory's compile tail and link steps left most cores idle, once
per subdirectory per pass.
Drop .NOTPARALLEL and encode the ordering the serial recursion relied
on as explicit dependencies between the per-subdirectory targets:
* The subdirectories that generate shared files in $(common-objpfx)
consumed by the rest of the build without explicit dependencies run
serially, in their sorted order, before the rest fan out: csu
provides the tree-wide gen-as-const headers, and on Hurd the mach
and hurd directories generate the MiG RPC headers (every other
subdirectory otherwise runs a nested make in hurd/ to create them,
racing under parallel recursion; see sysdeps/mach/hurd/Makefile).
The first of them also materializes the other shared generated files
(abi-versions.h, sysd-syscalls, before-compile headers).
* The edges requested by the Depend files (now emitted by
gen-sorted.awk as subdir-deps-*) are preserved. Edges pointing to
elf are dropped, as the sorted list already overrides them by
forcing elf last.
* The tests and xtests classes only run the per-directory test
programs, which are mutually independent once the others pass has
built the tree. They therefore carry only the others pass barrier
below and none of the csu-first or Depend edges (+ordered_parallel_-
subdir_targets excludes them); otherwise "make subdir/tests" would
also run the tests of every subdirectory reachable through those
edges, rather than just the requested one.
* elf stays last: its rtld link consumes $(common-objpfx)libc_pic.a,
which aggregates every other subdirectory's objects, and its
rtld-Rules recursion compiles into the other subdirectories' object
directories.
* Pass barriers replace the implicit pass ordering: others after lib
(a subdirectory others sub-make would otherwise race to link
libc.so itself), tests/xtests after others, and the testroot
install behind others.
* The threading (nptl, or htl on Hurd) and realtime (rt) tests are
timing-sensitive and were previously shielded from system load by
the global .NOTPARALLEL. With the recursion now parallel, a full
test run ('make check'/'tests', run-built-tests=yes) orders them
after the rest of the test run and one group at a time -- the
threading subdirectory, then rt -- and each serializes its own run
via a .NOTPARALLEL in its Makefile. A targeted 'make subdir/tests'
is not ordered.
The serialization (the per-subdirectory .NOTPARALLEL and the ordering
above) constrains only the test run, not the build of the test
programs; but building and running a subdirectory's tests are fused
in its sub-make, so under run-built-tests=yes the serialized
subdirectories would also build their test programs serially. To
avoid that, the top-level 'make check' (in Makerules) now runs two
passes: it builds every test program with run-built-tests=no, where
the recursion is fully parallel and none of the serialization
applies, and then runs the tests with run-built-tests=yes. 'make
tests' and a subdirectory's own 'check' stay single pass.
* The subdirectory-built files that the top-level libc.so and
linkobj/libc_pic.a rules list as prerequisites (elf/ld.so,
interp.os, sofini.os, sunrpc/librpc_compat_pic.a, and on Hurd
mach/libmachuser_pic.a and hurd/libhurduser_pic.a, from which the
lib*user-link.so inputs of libc.so are built) get order-only edges
on the corresponding sub-make with an explicit empty recipe. A
prerequisite-only rule would trigger an implicit rule search and
this level would compile them itself in the wrong context.
* The install, clean, abi, and stubs target classes keep the
previous total order via a serial dependency chain.
* The elf DSO sorting test recipes, run when make remakes the
included generated makefiles at parse time, create the elf object
directory before writing into it; the serial recursion no longer
guarantees another rule created it first.
* catgets builds locale-specific message catalogs (and tst-catgets
reads one) by running gencat under de_DE.ISO-8859-1, hr_HR.ISO-8859-2
and ja_JP.SJIS, but never declared those locales as prerequisites: it
relied on localedata running before it in the serial order. Under
the parallel recursion gencat could run before localedata generated
the locale, fall back to C, and fail. catgets/Makefile now pulls the
locales in via gen-locales.mk, like the other subdirectories that use
locales in their tests.
Results on a x86_64 machine [1] with default configuration [3]: a
from-scratch build improves from 78.728s to 61s, and check with
run-built-tests=no from 374s to 190s.
On a 80-core aarch64 machine [2] with default configuration [3]: a
from-scratch build improves from 105.251s to 56.703s, and check with
run-built-tests=no from 886.183s to 298.726s.
Build results are unchanged: all 8919 built objects, archives, and
shared objects are bit-identical to the serial build across 7 clean
parallel builds, the installed tree layout is identical, and the
tests.sum failure sets are identical. i686-gnu was verified with
repeated from-scratch builds.
[1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3
[2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3
[3] --enable-stack-protector=all --enable-bind-now=yes --enable-profile=yes
--enable-fortify-source=2 --enable-hardcoded-path-in-tests
Reviewed-by: Sam James <sam@gentoo.org>
gen-sorted.awk collects the inter-subdirectory dependencies from the
Depend files and the sysdeps Subdirs 'first' directives, but only uses
them to compute the flattened sorted-subdirs list.
This change also emit the raw edges as subdir-deps-<dir> make variables
so the parent makefile can express the same ordering as explicit
dependencies between the per-subdirectory recursion targets and run
independent subdirectories in parallel.
For instance, on x86_64-linux-gnu build the 'sysd-sorted' now shows:
[...]
subdir-deps-assert += iconvdata
subdir-deps-assert += localedata
subdir-deps-catgets += intl
subdir-deps-debug += localedata
subdir-deps-iconvdata += iconv
subdir-deps-iconvdata += localedata
subdir-deps-intl += iconvdata
subdir-deps-intl += localedata
subdir-deps-libio += localedata
subdir-deps-localedata += locale
[...]
Reviewed-by: Sam James <sam@gentoo.org>
Depending on parallelism, it's possible for domaindir/existing-locale/LC_MESSAGES
to have not been created yet:
```
msgfmt: error while opening "build/intl/domaindir/existing-locale/LC_MESSAGES/translit.mo" for writing: No such file or directory
make[2]: Leaving directory 'src/intl'
FAIL: intl/tst-translit
original exit status 1
cat: build/intl/tst-translit.out: No such file or directory
make[1]: *** [Makefile:944: test] Error 1
```
If so, the following msgfmt call will fail. Fix the typo in the mkdir call.
Arguably we should split these test preparations to avoid producing binaries
we know won't PASS because their support data is missing.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
Add support for [proc:*] syntax where * matches /proc/self/exe
(fallback: argv[0] unless AT_SECURE). Tunables after such a
line are limited to matching processes.
Note that this filter is reset when including a file or at
end of file.
If the filename starts with a slash (example: [proc:/bin/foo]) the
full path must match. If not (example: [proc:foo]) the basename is
matched.
Add support for filtering out AT_SECURE or non-AT_SECURE binaries:
$glibc.only-for.nonsecure-binaries=1
@glibc.only-for.secure-binaries=1
Reviewed-by: Arjun Shankar <arjun@redhat.com>
Load ld.so.cache and fetch the tunables extension. Apply
those tunables to the current program. We do not yet apply
security policies.
Reviewed-by: Arjun Shankar <arjun@redhat.com>
The purpose of this change is twofold:
1. The ld.so.cache is cached in memory and only re-read if/when
it changes on disk. This allows us to have much more intensive
security checks in the future, without impacting performance as
much. It also allows for cases where the cache is corrupted -
we continue using the last valid one.
2. We break out the load/check logic so that the cache can be
loaded independently of the library lookup, such as for
code that only needs to look at the extensions.
Reviewed-by: Arjun Shankar <arjun@redhat.com>
Adds support for reading /etc/tunables.conf
The file contains one line per tunable, like this:
glibc.foo.bar=14
glibc.malloc.more=0
Additionally, each line can be prefixed with a single word or character
that controls overridability by the GLIBC_TUNABLES env var:
overridable glibc.foo=0
+glibc.foo=0
^ May be overridden (the default)
nonoverridable glibc.foo=0
-glibc.foo=0
^ May not be overridden
The tunable cache format allows for a filter to be assigned to
each tunable, to be used at program start to decide if a tunable
applies to that program. No such filters have yet been specified.
The cache format also stores a pre-parsed value for the tunable, and
the ID of the tunable, to improve load-time performance.
Reviewed-by: Arjun Shankar <arjun@redhat.com>
2026-06-30 16:46:08 -04:00
715 changed files with 46974 additions and 29767 deletions
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
H.J. Lu
Andreas Schwab
Matt Turner
Ruslan Valiyev
Shamil Abdulaev
Hemanth Kumar M D
Florian Weimer
Dongkyun Son
Ondrej MarekandFrantisek Cech
Michael Pfeifroth
Samuel Thibault
Adhemerval Zanella
Yury Khrustalev
Collin Funk
Jiayuan Chen
Sam James
Moritz Klammler
Rolf Eike Beer
Magnus Lindholm
Azharul Haque
Siddhesh Poyarekar
mengqinggang
Andreas Schwab
Tiago Dinis
Xi Ruoyao
Matthias Goergens
Ross Burton
litenglong
Wilco Dijkstra
Arjun Shankar
jb2170
caiyinyu
Ryota Saito
Marcus Poller
Rudi Heitbaum
Frédéric Bérat
Mark Wielaard
Hammad Mengal
Andreas K. Hüttel
Peter Bergner
DJ DelorieandAdhemerval Zanella Netto
Stefan Liebler
Samuel Balazi