FTSENT::fts_namelen and fts_pathlen are unsigned short in glibc, but
fts_alloc stores the length of a root argument without checking it.
With an argument longer than USHRT_MAX both lengths wrap around, and
the fts_path of the root entry is truncated and may not be
NUL-terminated. glibc 2.43 failed with ENAMETOOLONG instead.
Make fts_alloc fail with ENAMETOOLONG if the name does not fit, so
fts_open fails as before.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
The fts implementation imported from gnulib in glibc 2.44 uses size_t
for path lengths, but glibc keeps the historical FTSENT layout, where
fts_pathlen is an unsigned short.
The overflow checks in fts_build and fts_palloc compare size_t values, so
they never trigger, and once a path gets longer than USHRT_MAX the
FTSENT::fts_pathlen wraps around.
Check for overflow against the type of the field that receives the
length, so fts_build fails with ENAMETOOLONG before a path gets longer
than USHRT_MAX.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
The fts implementation imported from gnulib in glibc 2.44 opens
directories with O_NOFOLLOW in an FTS_PHYSICAL walk, except for command
line arguments with FTS_COMFOLLOW. It does not take into account
entries that the application asked to follow with fts_set (FTS_FOLLOW),
fts_read stats the target of the symbolic link and returns it as FTS_D,
but opening it then fails with ENOTDIR, so it is returned again as
FTS_DNR and its contents are never visited. Without FTS_NOCHDIR, the
descriptor that fts keeps to return from the followed directory is also
leaked.
Mark the entries followed with FTS_FOLLOW with a new private fts_flags
bit (FTS_FOLLOWED). FTS_SYMFOLLOW can not be used because it is only set
when fts changes the working directory, and it implies a valid
fts_symfd. The directory of such an entry is opened without O_NOFOLLOW,
both in fts_build and in fts_safe_changedir. Since O_NOFOLLOW no longer
protects against the directory being replaced between the stat and the
open, fts_safe_changedir checks its device and inode as it already does
for FTS_LOGICAL. The fts implementation in glibc 2.43 always did this
check.
The test covers the default mode, FTS_NOCHDIR (as used by OpenSCAP,
where the issue was found), and FTS_CWDFD, following the link either
from the FTS_SL entry or from the fts_children list before fts_read
reaches it.
gnulib has the same issue since 2010.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reported-by: Matthew Burket <mburket@redhat.com>
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
When fts_read leaves a directory that the application asked it to
follow with fts_set (FTS_FOLLOW), it goes back through fts_symfd, a
descriptor for the parent directory saved when fts_read reached the
entry.
It does this for plain directories marked from the fts_children
list as well, not only for symbolic links. With FTS_CWDFD, FCHDIR
makes that descriptor the virtual working directory as if it were
changing one level down, so it also pushes the followed directory on
the descriptor ring, and fts_read then closes fts_symfd. fts_cwd_fd is
then a closed descriptor, the following entries fail with EBADF and are
returned as FTS_DNR or FTS_NS without their contents, while fts_read
and fts_close report success. fts also closes the descriptor again
later, and if the application opened a file in the meantime, it got
the same descriptor number, so fts uses that file as its working
directory and then closes it.
Make fts_symfd the virtual working directory without pushing the
current one, and drop the ring entry pushed when fts entered the
followed directory, since it refers to the same directory as
fts_symfd.
Following a symbolic link in a physical walk fails earlier because of
BZ 34775, but plain directories trigger the issue. The gnulib has the
same issue since FTS_CWDFD was added in 2006.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
Commit a8455a0b7f renamed the configure variable to
libc_cv_test_no_error_execstack, but config.make.in still substitutes
libc_cv_no_error_execstack.
Checked on x86_64-linux-gnu.
The la_pltexit path returned to the caller with 'br lr', and an indirect
branch must land on a BTI instruction (which the caller's return site
does not have).
Checked on aarch64-linux-gnu.
Reviewed-by: Yury Khrustalev <yury.khrustalev@arm.com>
The builddir Makefile runs a separate make in the source directory
for each goal, so 'make -jN check xcheck' runs both at the same time.
Since a subdirectory's xtests also builds and runs its tests, the two
instances build the same targets concurrently and fail when renaming
the shared temporary files.
Add .NOTPARALLEL so the goals run one after another; each still builds
in parallel.
Checked on x86_64-linux-gnu.
Reviewed-by: Arjun Shankar <arjun@redhat.com>
When a hypervisor exposes a Hygon CPUID vendor but omits cache topology,
shared_per_thread is zero. The generic cache initialization detects the
invalid threshold and uses a 64 MiB fallback, but the Hygon-specific
adjustment then overwrites it with shared_per_thread * 3 / 8, restoring
zero. memcpy and memmove consequently enter the non-temporal path for
small copies and can crash during process startup.
Only apply the Hygon heuristic when it produces a valid threshold. This
preserves the generic fallback when cache information is unavailable while
retaining the Hygon tuning with valid cache data.
Fixes: 213ffdfbba ("x86: Lower non-temporal copy threshold for Hygon")
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34875
Signed-off-by: Wang Lei <wangleiwave@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The SVE acoshf, asinhf, and atanhf special cases, and the
sv_log1pf_inline.h data, were incorporated by glibc f7eea1b258. The SVE
log1pf special case was incorporated by glibc a7b6e53462. The later
mathvec directory move preserved these changes.
Advance their SHARED-FILES revisions to the corresponding AOR commits.
Move size after info to fill the gap before end_of_fmt and remove the
trailing padding. On x86-64, struct printf_spec shrinks from 72 to 64
bytes while the offsets of all other members remain unchanged.
The 1024-byte specs buffer in printf_positional then holds 16 entries
instead of 14, avoiding its heap allocation for formats with 15 or 16
specifications. The public struct printf_info is unchanged.
Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
Place state next to previous_base to fill the gap before runp and remove
the trailing padding. On x86-64, struct ftw_frame shrinks from 192 to 184
bytes while the offsets of all other members remain unchanged.
Frames are allocated in blocks of 32, reducing each block allocation
from 6144 to 5888 bytes. The public ftw and nftw interfaces are unchanged.
Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
GL(dl_load_tls_lock) was introduced (bug 28357) to protect global and
module-specific TLS state, and dl_open_worker_begin conservatively runs
most of dlopen under it. The lock is also taken by pthread_create and
__tls_get_addr, so work done while holding it, such as the malloc calls
in _dl_find_object_update, can block unrelated threads. Hold it only
for the steps that need it.
Move the fallible _dl_find_object_update call, together with
activate_nodelete, update_scopes, the reloc_complete probe and the
libc early init call, from dl_open_worker_begin to dl_open_worker,
after dl_load_tls_lock has been released. These steps run after
relocation is complete and do not touch the TLS state that the lock
protects. They remain serialized against other dlopen and dlclose
calls by GL(dl_load_lock), which is held throughout.
The RT_CONSISTENT debugger/audit checkpoint is moved into
maybe_report_r_debug_consistent. It is called on the success path
before initializers run, and from _dl_open for the error path, and
ensures that the checkpoint is signalled exactly once. The order of
events relative to libc early init, the initializers and the error
cleanup is unchanged. The r_debug pointer used for the
reloc_start/reloc_complete probes is now kept in struct dl_open_args.
In dlclose, call _dl_find_object_dlclose for all unloaded objects in a
separate loop before dl_load_tls_lock and GL(dl_load_write_lock) are
taken. _dl_find_object readers are lock-free, and writers are
serialized by GL(dl_load_lock), so neither lock is needed for this
update. The objects are also marked as closed in the _dl_find_object
data before they are unlinked and unmapped.
Signed-off-by: Aliaksei Kandratsenka <alkondratenko@gmail.com>
Reviewed-by: Adhemerval Zanella adhemerval.zanella@linaro.org
_dl_find_object_update can fail with ENOMEM, but dlopen called it
after the demarcation point, after activate_nodelete and update_scopes
had already run. When the allocation failed, dlopen reported an error,
yet the new objects were already visible in the scopes. Any NODELETE
objects among them stayed loaded even though dlopen reported failure.
Call _dl_find_object_update before the demarcation point, so that its
failure is handled like any other recoverable dlopen error.
Add the tst-dlopen-oom test. It makes malloc fail at increasing
allocation counts during a dlopen of an RTLD_NODELETE object, and
checks that a failed dlopen leaves nothing behind.
Signed-off-by: Aliaksei Kandratsenka <alkondratenko@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
To report dlpi_subs, dl_iterate_phdr takes a global counter of module
loads and subtracts the number of currently loaded objects. It counts
those objects in the same loop that finds the caller's namespace, so
_ns_nloaded of each secondary namespace is added once per object in
that namespace instead of once in total.
Count the loaded objects in a separate loop. While there, stop the
namespace search at the first match.
The fix is trivial, and the bug was reported in 2016 and 2017. Kudos
to Gleb Natapov and Richard Biener for reporting it before me.
Extend tst-dlmodcount to also load and unload objects with dlmopen,
and to check that dlpi_subs does not change on load and dlpi_adds does
not change on unload.
Signed-off-by: Aliaksei Kandratsenka <alkondratenko@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
There is a small race window between checking that a segment may
contain the PC being looked up (pc >= seg->objects[0].map_start) and
bisecting that segment in _dlfo_lookup. A concurrent dlopen can
rewrite the segment in between. Then the "impossible" case of
first == first1 can occur, and _dlfo_lookup reads seg->objects[-1].
Explicitly checking for this case just before that access fixes the
issue. The lookup then fails the version check and is retried.
Signed-off-by: Aliaksei Kandratsenka <alkondratenko@gmail.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
This is my attempt at initial documentation for the la_* audit
interface, based on reading the code...
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Fix-up Makefiles that provide install-bin-script so that the scripts
could be generated without build all of Glibc. Such scripts would be
created in object directories that might not exist. Add commands to
create these directories before generating the scripts.
Also add install-{bin-script,sbin,rootsbin,others-programs} to the
'+subdir_targets' list to allow installing tools separately.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tag memory on systems that support MTE and when memory
tagging is enabled at runtime.
On AArch64, define the user allocation size alignment so
malloc request and usable size calculations do not expose the
MTE granule containing chunk metadata as usable allocation
space.
Currently we implement tagging as a wrapper around core malloc
functions. User pointers are expected to be tagged and internal
malloc pointers are untagged (or rather tagged with 0 tag).
Also add tests that check logical and allocation tags.
Co-authored-by: Yury Khrustalev <yury.khrustalev@arm.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
We introduce the ARCH_INIT_MALLOC() macro that is defined in
the sysdep headers to allow doing target-specific initialisation
in __ptmalloc_init. On AArch64 we use this macro to modify
global variables in malloc.c when MTE is enabled based on the
runtime value calculated from the glibc.cpu.mtemode tunable.
On AArch64, this macro also initialises extra_mmap_prot to
PROT_MTE.
We modify ifunc resolvers for AArch64 to return MTE-aware versions
of malloc functions when MTE is active. At this point these *_mte
functions don't actually do any memory tagging. This will be done
in a subsequent commit.
Finally, we add the glibc.cpu.mtemode tunable to all malloc
tests on AArch64. On systems without MTE this will have no effect
but on systems with MTE it will make sure that tests are executed
with memory tagging enabled in sync mode.
Co-authored-by: Yury Khrustalev <yury.khrustalev@arm.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
Add a sysdep hook for additional user allocation size alignment
requirements used by request-size and usable-size calculations.
Use the same hook for tcache usable-size calculations and allow the
small calloc clear helper to fall back to memset for allocations whose
usable size is smaller than the unrolled clear path supports.
Reviewed-by: DJ Delorie <dj@redhat.com>
Implements single precision vector fallback for tanf
based on the recently vectorised sinf and cosf fallback.
Uses tan(x) = sin(x)/cos(x) to approximate results where
the fast reduction path fails. This is roughly 50% higher
throughput than a scalar fallback.
Includes optimisations to the fast path to use lanewise
operations and more efficient loads. Improves throughput
by 6% with no change to results.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The rsqrt input list only has 1000 random values in [0.5,2) and does not
define any workload, so it reports a single mean for two binades. Add
named workloads so the paths an implementation takes can be measured
separately:
- workload-[0.5,2): the previous inputs.
- workload-normal: positive normal inputs, uniform over the
representable numbers so that every binade is exercised.
- workload-subnormal: subnormal inputs.
The rsqrtf input list only has 1000 random values in [0.5,2) and does not
define any workload. Add named workloads and define new ranges:
- workload-[0.5,2): the previous inputs.
- workload-normal: positive normal inputs, uniform over the
representable numbers.
- workload-subnormal: subnormal inputs.
pthread_mutex_lock, pthread_mutex_timedlock, and pthread_mutex_trylock
acquire a not recoverable robust mutex and release it with lll_unlock
before returning ENOTRECOVERABLE. lll_unlock only wakes a waiter if the
lock value is larger than 1, which is never true for a robust lock with
FUTEX_WAITERS (bit 31) set.
Since pthread_mutex_unlock wakes only one waiter when the mutex becomes
not recoverable, and the woken thread acquires the lock with FUTEX_WAITERS
set, the remaining waiters block forever.
Release the lock as __pthread_mutex_unlock_full does, waking a waiter
if FUTEX_WAITERS was set.
Checked on x86_64-linux-gnu and aarch64-linux-gnu.
setcontext.S marks setcontext weak with .weak and then defines it with
ENTRY, which emits .global. GNU as lets .weak win, but LLVM's
integrated assembler rejects the change of binding (deliberately, since
LLVM 12), so the file does not assemble with clang:
error: setcontext changed binding to STB_GLOBAL
Define the stub as __libc_setcontext and export it with weak_alias, as
getcontext, makecontext and swapcontext in the same directory already
do. setcontext stays a weak GLIBC_2.2 function.
Tested on sparc64 with gcc: the dynamic symbol for setcontext is
unchanged, check-abi passes, and the stdlib ucontext tests pass. With
clang the file now assembles without errors or warnings.
Signed-off-by: Stian Halseth <stian@itx.no>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The sparc kernel's struct termios2 declares 19 c_cc entries, but
TCGETS2 only writes the first 17 and TCSETS2 only reads them. Since
the termios rework in glibc 2.42, tcgetattr copies all 19 from an
uninitialized struct termios2 on its stack, so c_cc[17] and c_cc[18]
return whatever was there before. Two tcgetattr calls on the same
terminal can then disagree, which fails Python's test_termios and
test_tty.
Set _TERMIOS2_NCCS to 17 for sparc, as __KERNEL_NCCS was before 2.42.
The struct size and layout do not change, since c_ispeed is aligned to
4 bytes either way, and c_cc[17] onwards is filled with _POSIX_VDISABLE
again.
Add a test that calls tcgetattr twice with different stack contents
and compares the results.
Link: https://github.com/sparclinux/issues/issues/112
Signed-off-by: Stian Halseth <stian@itx.no>
Reviewed-by: Avinal Kumar <avinal.xlvii@gmail.com>
Applications cannot trust this information. They need to issue
a system call like:
arch_prctl (ARCH_REQ_XCOMP_PERM,X86_XSTATE_TILEDATA_ID
And this system call could be blocked by seccomp, so something
based on CPUID and XCR0 does not capture that.
Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
Fix an incorrect use of CHUNK_HDR_SZ where chunksize2usable should be used.
Also use chunksize2usable instead of musable in __libc_realloc.
Revewied-by: DJ Delorie <dj@redhat.com>
The `j` pseudo-instruction uses an R_RISCV_JAL relocation, limiting the
target to the JAL ±1 MiB range. PGO/LTO function/section reordering
may place `__sigjmp_save` outside this range and cause the final link
to fail.
Use `tail` instead, which emits R_RISCV_CALL_PLT and permits the linker
to relax the call when possible.
Signed-off-by: Mingliang Liu <liumingliang.dev@bytedance.com>
Reviewed-by: Peter Bergner <bergner@tenstorrent.com>
The static-startup symbol redirection for LoongArch pointed memcpy and
memmove at the unaligned implementations, which assume unaligned access
support (UAL). Redirect them to the aligned implementations, matching
the default IFUNC selection, so they do not rely on unaligned accesses.
While ac61ed310d ("Fix handling of SA_RESETHAND and SA_NODEFER") made
SA_RESETHAND follow Posix in not resetting the handler to SIG_DFL, Linux
does reset it and thus applications do expect it to be reset. It is indeed
convenient for them to print a backtrace and let SIGILL then take actual
effect.
glibc is responsible for turning EPIPE into SIGPIPE, so do not pass it
to the translator which will either not know it (and return EINVAL), or
not know what to do about it.
By convention the first uid/gid is the euid/egid. Ensure that the
first uid/gid in the array passed to auth_makeauth is the egid/egid to
not unexpectedly overwrite it.
setuids is analogous to setgroups so make it match signatures.
This changes ABI on 64b, but this function is essentially unused for
now, better fix its ABI already.
Adhemerval Zanella