H.J. Lu [Fri, 28 Jul 2023 21:06:01 +0000 (14:06 -0700)]
x86/cet: Don't disable CET if not single threaded
In permissive mode, don't disable IBT nor SHSTK when dlopening a legacy
shared library if not single threaded since IBT and SHSTK may be still
enabled in other threads. Other threads with IBT or SHSTK enabled will
crash when calling functions in the legacy shared library. Instead, an
error will be issued.
H.J. Lu [Fri, 24 Mar 2023 20:20:06 +0000 (13:20 -0700)]
x86: Modularize sysdeps/x86/dl-cet.c
Improve readability and make maintenance easier for dl-feature.c by
modularizing sysdeps/x86/dl-cet.c:
1. Support processors with:
a. Only IBT. Or
b. Only SHSTK. Or
c. Both IBT and SHSTK.
2. Lock CET features only if IBT or SHSTK are enabled and are not
enabled permissively.
H.J. Lu [Sun, 16 Jan 2022 20:09:57 +0000 (12:09 -0800)]
x86/cet: Update tst-cet-vfork-1
Change tst-cet-vfork-1.c to verify that vfork child return triggers
SIGSEGV due to shadow stack mismatch.
Szabolcs Nagy [Wed, 29 Nov 2023 11:31:37 +0000 (11:31 +0000)]
elf: Add TLS modid reuse test for bug 29039
This is a minimal regression test for bug 29039 which only affects
targets with TLSDESC and a reproducer requires that
1) Have modid gaps (closed modules) with old generation.
2) Update a DTV to a newer generation (needs a newer dlopen).
3) But do not update the closed gap entry in that DTV.
4) Reuse the modid gap for a new module (another dlopen).
5) Use dynamic TLSDESC in that new module with old generation (bug).
6) Access TLS via this TLSDESC and the now outdated DTV.
However step (3) in practice rarely happens: during DTV update the
entries for closed modids are initialized to "unallocated" and then
dynamic TLSDESC calls __tls_get_addr independently of its generation.
The only exception to this is DTV setup at thread creation (gaps are
initialized to NULL instead of unallocated) or DTV resize where the
gap entries are outside the previous DTV array (again NULL instead
of unallocated, and this requires loading > DTV_SURPLUS modules).
So the bug can only cause NULL (+ offset) dereference, not use after
free. And the easiest way to get (3) is via thread creation.
Note that step (5) requires that the newly loaded module has larger
TLS than the remaining optional static TLS. And for (6) there cannot
be other TLS access or dlopen in the thread that updates the DTV.
Tested on aarch64-linux-gnu.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Joe Ramsay [Mon, 18 Dec 2023 15:51:16 +0000 (15:51 +0000)]
aarch64: Add SIMD attributes to math functions with vector versions
Added annotations for autovec by GCC and GFortran - this enables GCC
>= 9 to autovectorise math calls at -Ofast.
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Joe Ramsay [Tue, 19 Dec 2023 16:44:01 +0000 (16:44 +0000)]
aarch64: Add half-width versions of AdvSIMD f32 libmvec routines
Compilers may emit calls to 'half-width' routines (two-lane
single-precision variants). These have been added in the form of
wrappers around the full-width versions, where the low half of the
vector is simply duplicated. This will perform poorly when one lane
triggers the special-case handler, as there will be a redundant call
to the scalar version, however this is expected to be rare at Ofast.
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Stefan Liebler [Wed, 13 Dec 2023 11:44:50 +0000 (12:44 +0100)]
Fix elf/tst-env-setuid[-static] if test needs to be rerun.
If /tmp is mounted nosuid and make xcheck is run,
then tst-env-setuid fails UNSUPPORTED with "SGID failed: GID and EGID match"
and /var/tmp/tst-sonamemove-runmod1.so.profile is created.
If you then try to rerun the test with a suid mounted test-dir
(the SGID binary is created in test-dir which defaults to /tmp)
with something like that:
make tst-env-setuid-ENV="TMPDIR=..." t=elf/tst-env-setuid test
the test fails as the LD_PROFILE output file is still available
from the previous run.
Thus this patch removes the LD_PROFILE output file in parent
before spawning the SGID binary.
Even if LD_PROFILE is not supported anymore in static binaries,
use a different library and thus output file for tst-env-setuid
and tst-env-setuid-static in order to not interfere if both
tests are run in parallel.
Furthermore the checks in test_child are now more verbose.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
H.J. Lu [Wed, 20 Dec 2023 00:01:33 +0000 (16:01 -0800)]
Fix elf: Do not duplicate the GLIBC_TUNABLES string
commit
2a969b53c0b02fed7e43473a92f219d737fd217a
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Wed Dec 6 10:24:01 2023 -0300
elf: Do not duplicate the GLIBC_TUNABLES string
has
@@ -38,7 +39,7 @@
which isn't available. */
#define CHECK_GLIBC_IFUNC_PREFERRED_OFF(f, cpu_features, name, len) \
_Static_assert (sizeof (#name) - 1 == len, #name " != " #len); \
- if (memcmp (f, #name, len) == 0) \
+ if (tunable_str_comma_strcmp_cte (&f, #name) == 0) \
{ \
cpu_features->preferred[index_arch_##name] \
&= ~bit_arch_##name; \
@@ -46,12 +47,11 @@
Fix it by removing "== 0" after tunable_str_comma_strcmp_cte.
H.J. Lu [Tue, 19 Dec 2023 17:55:25 +0000 (09:55 -0800)]
tst-setcontext10.c: Undef _FORTIFY_SOURCE
When _FORTIFY_SOURCE is defined to 2, ____longjmp_chk is called,
instead of longjmp. ____longjmp_chk compares the relative stack
values to decide if it is called from a stack frame which called
setjmp. If not, ____longjmp_chk assumes that an alternate signal
stack is used. Since comparing the relative stack values isn't
reliable with user context, when there is no signal, ____longjmp_chk
will fail. Undefine _FORTIFY_SOURCE to avoid ____longjmp_chk in
user context test.
H.J. Lu [Tue, 19 Dec 2023 21:21:06 +0000 (13:21 -0800)]
Fix elf: Do not duplicate the GLIBC_TUNABLES string
Fix issues in sysdeps/x86/tst-hwcap-tunables.c added by
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Wed Dec 6 10:24:01 2023 -0300
elf: Do not duplicate the GLIBC_TUNABLES string
1. -AVX,-AVX2,-AVX512F should be used to disable AVX, AVX2 and AVX512.
2. AVX512 IFUNC functions check AVX512VL. -AVX512VL should be added
to disable these functions.
This fixed:
FAIL: elf/tst-hwcap-tunables
...
[0] Spawned test for -Prefer_ERMS,-Prefer_FSRM,-AVX,-AVX2,-AVX_Usable,-AVX2_Usable,-AVX512F_Usable,-SSE4_1,-SSE4_2,-SSSE3,-Fast_Unaligned_Load,-ERMS,-AVX_Fast_Unaligned_Load
error: subprocess failed: tst-tunables
error: unexpected output from subprocess
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
[1] Spawned test for ,-,-Prefer_ERMS,-Prefer_FSRM,-AVX,-AVX2,-AVX_Usable,-AVX2_Usable,-AVX512F_Usable,-SSE4_1,-SSE4_2,,-SSSE3,-Fast_Unaligned_Load,,-,-ERMS,-AVX_Fast_Unaligned_Load,-,
error: subprocess failed: tst-tunables
error: unexpected output from subprocess
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
../sysdeps/x86/tst-hwcap-tunables.c:91: numeric comparison failure
left: 1 (0x1); from: impls[i].usable
right: 0 (0x0); from: false
error: 2 test failures
on Intel Tiger Lake.
Bruno Haible [Thu, 2 Nov 2023 19:19:44 +0000 (16:19 -0300)]
hppa: Fix undefined behaviour in feclearexcept (BZ 30983)
The expression
(excepts & FE_ALL_EXCEPT) << 27
produces a signed integer overflow when 'excepts' is specified as
FE_INVALID (= 0x10), because
- excepts is of type 'int',
- FE_ALL_EXCEPT is of type 'int',
- thus (excepts & FE_ALL_EXCEPT) is (int) 0x10,
- 'int' is 32 bits wide.
The patched code produces the same instruction sequence as
previosuly.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Bruno Haible [Thu, 2 Nov 2023 14:23:48 +0000 (11:23 -0300)]
alpha: Fix fesetexceptflag (BZ 30998)
It clears some exception flags that are outside the EXCEPTS argument.
It fixes math/test-fexcept on qemu-user.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Adhemerval Zanella [Thu, 2 Nov 2023 14:15:55 +0000 (11:15 -0300)]
riscv: Fix feenvupdate with FE_DFL_ENV (BZ 31022)
libc_feupdateenv_riscv should check for FE_DFL_ENV, similar to
libc_fesetenv_riscv.
Also extend the test-fenv.c to test fenvupdate.
Checked on riscv under qemu-system.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Bruno Haible [Wed, 1 Nov 2023 01:10:11 +0000 (02:10 +0100)]
manual: Clarify undefined behavior of feenableexcept (BZ 31019)
Explain undefined behavior of feenableexcept in a special case.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Bruno Haible [Tue, 24 Oct 2023 11:37:16 +0000 (08:37 -0300)]
x86: Do not raises floating-point exception traps on fesetexceptflag (BZ 30990)
According to ISO C23 (7.6.4.4), fesetexcept is supposed to set
floating-point exception flags without raising a trap (unlike
feraiseexcept, which is supposed to raise a trap if feenableexcept
was called with the appropriate argument).
The flags can be set in the 387 unit or in the SSE unit. When we need
to clear a flag, we need to do so in both units, due to the way
fetestexcept is implemented.
When we need to set a flag, it is sufficient to do it in the SSE unit,
because that is guaranteed to not trap. However, on i386 CPUs that have
only a 387 unit, set the flags in the 387, as long as this cannot trap.
Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Adhemerval Zanella [Tue, 24 Oct 2023 11:37:15 +0000 (08:37 -0300)]
i686: Do not raise exception traps on fesetexcept (BZ 30989)
According to ISO C23 (7.6.4.4), fesetexcept is supposed to set
floating-point exception flags without raising a trap (unlike
feraiseexcept, which is supposed to raise a trap if feenableexcept
was called with the appropriate argument).
The flags can be set in the 387 unit or in the SSE unit. To set
a flag, it is sufficient to do it in the SSE unit, because that is
guaranteed to not trap. However, on i386 CPUs that have only a
387 unit, set the flags in the 387, as long as this cannot trap.
Checked on i686-linux-gnu.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Adhemerval Zanella [Tue, 24 Oct 2023 11:37:14 +0000 (08:37 -0300)]
powerpc: Do not raise exception traps for fesetexcept/fesetexceptflag (BZ 30988)
According to ISO C23 (7.6.4.4), fesetexcept is supposed to set
floating-point exception flags without raising a trap (unlike
feraiseexcept, which is supposed to raise a trap if feenableexcept was
called with the appropriate argument).
This is a side-effect of how we implement the GNU extension
feenableexcept, where feenableexcept/fesetenv/fesetmode/feupdateenv
might issue prctl (PR_SET_FPEXC, PR_FP_EXC_PRECISE) depending of the
argument. And on PR_FP_EXC_PRECISE, setting a floating-point exception
flag triggers a trap.
To make the both functions follow the C23, fesetexcept and
fesetexceptflag now fail if the argument may trigger a trap.
The math tests now check for an value different than 0, instead
of bail out as unsupported for EXCEPTION_SET_FORCES_TRAP.
Checked on powerpc64le-linux-gnu.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Adhemerval Zanella [Wed, 6 Dec 2023 13:24:02 +0000 (10:24 -0300)]
elf: Do not set invalid tunables values
The loader now warns for invalid and out-of-range tunable values. The
patch also fixes the parsing of size_t maximum values, where
_dl_strtoul was failing for large values close to SIZE_MAX.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Wed, 6 Dec 2023 13:24:01 +0000 (10:24 -0300)]
elf: Do not duplicate the GLIBC_TUNABLES string
The tunable parsing duplicates the tunable environment variable so it
null-terminates each one since it simplifies the later parsing. It has
the drawback of adding another point of failure (__minimal_malloc
failing), and the memory copy requires tuning the compiler to avoid mem
operations calls.
The parsing now tracks the tunable start and its size. The
dl-tunable-parse.h adds helper functions to help parsing, like a strcmp
that also checks for size and an iterator for suboptions that are
comma-separated (used on hwcap parsing by x86, powerpc, and s390x).
Since the environment variable is allocated on the stack by the kernel,
it is safe to keep the references to the suboptions for later parsing
of string tunables (as done by set_hwcaps by multiple architectures).
Checked on x86_64-linux-gnu, powerpc64le-linux-gnu, and
aarch64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Joseph Myers [Tue, 19 Dec 2023 16:00:11 +0000 (16:00 +0000)]
Do not build sparc32 libgcc functions into static libc
Since GCC commit
f31a019d1161ec78846473da743aedf49cca8c27 "Emit
funcall external declarations only if actually used.", the glibc
testsuite has failed to build for 32-bit SPARC with GCC mainline.
/scratch/jmyers/glibc-bot/install/compilers/sparc64-linux-gnu/lib/gcc/sparc64-glibc-linux-gnu/14.0.0/../../../../sparc64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/install/compilers/sparc64-linux-gnu/lib/gcc/sparc64-glibc-linux-gnu/14.0.0/32/libgcc.a(_divsi3.o): in function `.div':
/scratch/jmyers/glibc-bot/src/gcc/libgcc/config/sparc/lb1spc.S:138: multiple definition of `.div'; /scratch/jmyers/glibc-bot/build/glibcs/sparcv9-linux-gnu/glibc/libc.a(sdiv.o):/scratch/jmyers/glibc-bot/src/glibc/gnulib/../sysdeps/sparc/sparc32/sparcv9/sdiv.S:13: first defined here
/scratch/jmyers/glibc-bot/install/compilers/sparc64-linux-gnu/lib/gcc/sparc64-glibc-linux-gnu/14.0.0/../../../../sparc64-glibc-linux-gnu/bin/ld: disabling relaxation; it will not work with multiple definitions
collect2: error: ld returned 1 exit status
make[3]: *** [../Rules:298: /scratch/jmyers/glibc-bot/build/glibcs/sparcv9-linux-gnu/glibc/nptl/tst-cancel24-static] Error 1
https://sourceware.org/pipermail/libc-testresults/2023q4/012154.html
I'm not sure of the exact sequence of undefined references that cause
first the glibc object file defining .div and then the libgcc object
file defining both .div and .udiv to be pulled in (which must have
been perturbed by that GCC change in a way that introduced the build
failure), but I think the failure illustrates that it's inherently
fragile for glibc to define symbols in separate object files that
libgcc defines in the same object file - and indeed for glibc to
redefine libgcc symbols at all, since the division into object files
shouldn't really be part of the interface between libgcc and libc.
These symbols appear to be in libc only for compatibility, maybe one
of the cases where they were accidentally exported from shared libc in
glibc 2.0 before the introduction of symbol versioning and so programs
started expecting shared libc to provide them. Thus, there is no need
to have them in static libc. Add this set of libgcc functions to
shared-only-routines so they are no longer provided in static libc.
(No change is made regarding .mul - dotmul source file - since unlike
the other symbols in this grouping, it doesn't actually appear to be a
libgcc symbol, at least in current GCC.)
Tested with build-many-glibcs.py for sparcv9-linux-gnu with GCC
mainline.
H.J. Lu [Tue, 28 Mar 2023 20:52:36 +0000 (13:52 -0700)]
x86/cet: Check CPU_FEATURE_ACTIVE in permissive mode
Verify that CPU_FEATURE_ACTIVE works properly in permissive mode.
H.J. Lu [Wed, 22 Mar 2023 20:34:55 +0000 (13:34 -0700)]
x86/cet: Check legacy shadow stack code in .init_array section
Verify that legacy shadow stack code in .init_array section in application
and shared library, which are marked as shadow stack enabled, will trigger
segfault.
H.J. Lu [Fri, 17 Mar 2023 23:21:49 +0000 (16:21 -0700)]
x86/cet: Add tests for GLIBC_TUNABLES=glibc.cpu.hwcaps=-SHSTK
Verify that GLIBC_TUNABLES=glibc.cpu.hwcaps=-SHSTK turns off shadow
stack properly.
H.J. Lu [Fri, 10 Mar 2023 21:18:10 +0000 (13:18 -0800)]
x86/cet: Check CPU_FEATURE_ACTIVE when CET is disabled
Verify that CPU_FEATURE_ACTIVE (SHSTK) works properly when CET is
disabled.
H.J. Lu [Tue, 21 Mar 2023 19:53:24 +0000 (12:53 -0700)]
x86/cet: Check legacy shadow stack applications
Add tests to verify that legacy shadow stack applications run properly
when shadow stack is enabled in Linux kernel.
Mike FABIAN [Tue, 19 Dec 2023 09:48:42 +0000 (10:48 +0100)]
localedata: id_ID: change first weekday to Sunday
Resolves: BZ # 30412
See: https://sourceware.org/bugzilla/show_bug.cgi?id=30412#c7
CLDR also has ID in the list of territories which have Sunday as the
first day of the week.
Stefan Liebler [Fri, 15 Dec 2023 08:26:40 +0000 (09:26 +0100)]
s390: Set psw addr field in getcontext and friends.
So far if the ucontext structure was obtained by getcontext and co,
the return address was stored in general purpose register 14 as
it is defined as return address in the ABI.
In contrast, the context passed to a signal handler contains the address
in psw.addr field.
If somebody e.g. wants to dump the address of the context, the origin
needs to be known.
Now this patch adjusts getcontext and friends and stores the return address
also in psw.addr field.
Note that setcontext isn't adjusted and it is not supported to pass a
ucontext structure from signal-handler to setcontext. We are not able to
restore all registers and branching to psw.addr without clobbering one
register.
Matthew Sterrett [Fri, 15 Dec 2023 20:04:05 +0000 (12:04 -0800)]
x86: Unifies 'strlen-evex' and 'strlen-evex512' implementations.
This commit uses a common implementation 'strlen-evex-base.S' for both
'strlen-evex' and 'strlen-evex512'
The motivation is to reduce the number of implementations to maintain.
This incidentally gives a small performance improvement.
All tests pass on x86.
Benchmarks were taken on SKX.
https://www.intel.com/content/www/us/en/products/sku/123613/intel-core-i97900x-xseries-processor-13-75m-cache-up-to-4-30-ghz/specifications.html
Geometric mean for strlen-evex512 over all benchmarks (N=10) was (new/old) 0.939
Geometric mean for wcslen-evex512 over all benchmarks (N=10) was (new/old) 0.965
Code Size Changes:
strlen-evex512.S : +24 bytes
wcslen-evex512.S : +54 bytes
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
H.J. Lu [Sat, 16 Dec 2023 16:53:12 +0000 (08:53 -0800)]
x86/cet: Don't assume that SHSTK implies IBT
Since shadow stack (SHSTK) is enabled in the Linux kernel without
enabling indirect branch tracking (IBT), don't assume that SHSTK
implies IBT. Use "CPU_FEATURE_ACTIVE (IBT)" to check if IBT is active
and "CPU_FEATURE_ACTIVE (SHSTK)" to check if SHSTK is active.
RushingAlien [Mon, 21 Aug 2023 03:55:30 +0000 (10:55 +0700)]
id_ID: Update Time Locales
Hello! I am Indonesian, was born and raised in Indonesia and still do live in
Indonesia.
This patch brings a few changes to the time locales of id_ID, which
includes :
\- Defining am_pm and time_fmpt_ampm
\- Changing time_fmt and d_t_fmt to use the 24-hour format
\- Changing first_weekday to Monday
This is a squashed version of what is previously a 5 patch set
Here are reasons and details of the changes :
Change 1 part 1
id_ID: Define `am_pm` string
Current formatting does not define am_pm string, leading to AM and PM
not being specified in 12 H time format. This change defines the string
by changing it from an empty string to "AM";"PM".
output of `date +%r`:
before commit: 01:23
after commit: 01:23 PM
Change 1 part 2
id_ID: Define time_fmt_ampm, change from an empty string
Currently, time_fmpt_ampm is set to an empty string, causing some
programs to not be able to display time in the 12-hour format, for
example, glib: https://gitlab.gnome.org/GNOME/glib/-/issues/2967.
This commit changes it from an empty string to "%I:%M:%S %p"
Change 2 part 1
id_ID: Use 24-hour format for time_fmt
Indonesian standard and formal time format uses the 24-hour format inst-
ead of the 12-hour format. This commit aims to change the id_ID locale's
time_fmt to match that accordingly.
Change 2 part 2
id_ID: Use 24-hour format for d_t_fmt.
Indonesian standard and formal time format uses the 24-hour format inst-
ead of the 12-hour format. This commit aims to change the id_ID locale's
d_t_fmt to match that accordingly.
Change 3
id_ID: Change first_weekday to monday
Indonesian calendar starts of the week with Monday, let's comply
Message-ID: <
20230821035530.9075-1-rushing27alien@gmail.com>
Resolves: BZ # 30412
Reviewed-by: Mike Fabian <mfabian@redhat.com>
Flavio Cruz [Thu, 14 Dec 2023 06:02:28 +0000 (01:02 -0500)]
Update code to handle the new ABI for sending inlined port rights.
For i686, this change is no op but for x86_64 it forces all inlined port
rights to be 8 bytes long.
H.J. Lu [Sat, 16 Dec 2023 16:53:10 +0000 (08:53 -0800)]
x86/cet: Check user_shstk in /proc/cpuinfo
Linux kernel reports CPU shadow stack feature in /proc/cpuinfo as
user_shstk, instead of shstk.
H.J. Lu [Thu, 14 Dec 2023 19:37:03 +0000 (11:37 -0800)]
Add a test for setjmp/longjmp within user context
Verify that setjmp/longjmp works correctly within a user context.
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
H.J. Lu [Thu, 14 Dec 2023 19:37:02 +0000 (11:37 -0800)]
Add a test for longjmp from user context
Verify that longjmp works correctly after setcontext is called to switch
to a user context.
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
Manjunath Matti [Tue, 5 Dec 2023 12:38:47 +0000 (06:38 -0600)]
powerpc: Add space for HWCAP3/HWCAP4 in the TCB for future Power.
This patch reserves space for HWCAP3/HWCAP4 in the TCB of powerpc.
These hardware capabilities bits will be used by future Power
architectures.
Versioned symbol '__parse_hwcap_3_4_and_convert_at_platform' advertises
the availability of the new HWCAP3/HWCAP4 data in the TCB.
This is an ABI change for GLIBC 2.39.
Suggested-by: Peter Bergner <bergner@linux.ibm.com>
Reviewed-by: Peter Bergner <bergner@linux.ibm.com>
Amrita H S [Fri, 15 Dec 2023 16:48:17 +0000 (11:48 -0500)]
powerpc: Fix performance issues of strcmp power10
Current implementation of strcmp for power10 has
performance regression for multiple small sizes
and alignment combination.
Most of these performance issues are fixed by this
patch. The compare loop is unrolled and page crosses
of unrolled loop is handled.
Thanks to Paul E. Murphy for helping in fixing the
performance issues.
Signed-off-by: Amrita H S <amritahs@linux.vnet.ibm.com>
Co-Authored-By: Paul E. Murphy <murphyp@linux.ibm.com>
Reviewed-by: Rajalakshmi Srinivasaraghavan <rajis@linux.ibm.com>
Mike FABIAN [Thu, 14 Dec 2023 09:18:17 +0000 (10:18 +0100)]
localedata: Convert el_GR and el_CY locales to UTF-8
Mike FABIAN [Thu, 14 Dec 2023 09:12:46 +0000 (10:12 +0100)]
localedata: el_GR: Greece now uses the 24h format for time
Resolves: BZ # 23012
MAHESH BODAPATI [Tue, 12 Dec 2023 14:52:45 +0000 (08:52 -0600)]
powerpc : Add optimized memchr for POWER10
Optimized memchr for POWER10 based on existing rawmemchr and strlen.
Reordering instructions and loop unrolling helped in getting better performance.
Reviewed-by: Rajalakshmi Srinivasaraghavan <rajis@linux.ibm.com>
Bruno Haible [Tue, 12 Dec 2023 08:45:16 +0000 (09:45 +0100)]
intl: Treat C.UTF-8 locale like C locale, part 2 (BZ# 16621)
The previous commit was incomplete: gettext() still returns a translation
if the file /usr/share/locale/C/LC_MESSAGES/<domain>.mo exists. This patch
prohibits the translation also in this case.
* gettext-runtime/intl/dcigettext.c (DCIGETTEXT): Treat C.<encoding> locale
like the C locale.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Ludwig Rydberg [Mon, 11 Dec 2023 12:50:41 +0000 (13:50 +0100)]
resolv: Fix a few unaligned accesses to fields in HEADER
After refactoring the alloca usage in
40c0add7d4 ("resolve: Remove
__res_context_query alloca usage") a few unaligned accesses to HEADER
fields surfaced. These unaligned accesses led to problems when running
the resolv test suite on sparc32-linux (leon) as many tests failed due to
SIGBUS crashes.
The issue(s) occured during T_QUERY_A_AND_AAAA queries as the second query
now can start on an unaligned address (previously it was explicitly aligned).
With this patch the unaligned accesses are now fixed by using the
UHEADER instead to ensure the fields are accessed with byte
loads/stores.
The patch has been verfied by running the resolv test suite on sparc32
and x86_64.
Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
H.J. Lu [Thu, 7 Dec 2023 21:05:39 +0000 (13:05 -0800)]
x86: Check PT_GNU_PROPERTY early
The PT_GNU_PROPERTY segment is scanned before PT_NOTE. For binaries
with the PT_GNU_PROPERTY segment, we can check it to avoid scan of
the PT_NOTE segment.
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
H.J. Lu [Thu, 7 Dec 2023 17:00:11 +0000 (09:00 -0800)]
sysdeps/x86/Makefile: Split and sort tests
Put each test on a separate line and sort tests.
Florian Weimer [Fri, 8 Dec 2023 08:51:34 +0000 (09:51 +0100)]
elf: Initialize GLRO(dl_lazy) before relocating libc in dynamic startup
GLRO(dl_lazy) is used to set the parameters for the early
_dl_relocate_object call, so the consider_profiling setting has to
be applied before the call.
Fixes commit
78ca44da0160a0b442f0ca1f253e3360f044b2ec ("elf: Relocate
libc.so early during startup and dlmopen (bug 31083)").
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Siddhesh Poyarekar [Thu, 12 Oct 2023 16:50:49 +0000 (12:50 -0400)]
Move CVE information into advisories directory
One of the requirements to becoming a CVE Numbering Authority (CNA) is
to publish advisories. Do this by maintaining a file for each CVE fixed
in the advisories directory in the source tree. Links to the advisories
can then be shared as:
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-YYYY-NNNN
The file format at the moment is rudimentary and derives from the git
commit format, i.e. a subject line and a potentially multi-paragraph
description and then tags to describe some meta information. This is a
loose format at the moment and could change as we evolve this.
Also add a script process-fixed-cves.sh that processes these advisories
and generates a list to add to NEWS at release time.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Amrita H S [Wed, 6 Dec 2023 16:43:11 +0000 (11:43 -0500)]
powerpc: Optimized strcmp for power10
This patch is based on __strcmp_power9 and __strlen_power10.
Improvements from __strcmp_power9:
1. Uses new POWER10 instructions
- This code uses lxvp to decrease contention on load
by loading 32 bytes per instruction.
2. Performance implication
- This version has around 30% better performance on average.
- Performance regression is seen for a specific combination
of sizes and alignments. Some of them is observed without
changes also, while rest may be induced by the patch.
Signed-off-by: Amrita H S <amritahs@linux.vnet.ibm.com>
Reviewed-by: Paul E. Murphy <murphyp@linux.ibm.com>
Adhemerval Zanella [Thu, 7 Dec 2023 14:17:35 +0000 (11:17 -0300)]
elf: Fix wrong break removal from
8ee878592c
Reported-by: Alexander Monakov <amonakov@ispras.ru>
Mike FABIAN [Tue, 5 Dec 2023 19:22:36 +0000 (20:22 +0100)]
localedata: Convert day names in nn_NO locale to UTF-8
Mike FABIAN [Wed, 29 Nov 2023 09:46:38 +0000 (10:46 +0100)]
localedata: Remove trailing whitespace in weekday names in nn_NO locale
Resolves: BZ # 25868
Adhemerval Zanella [Wed, 22 Nov 2023 20:43:25 +0000 (17:43 -0300)]
elf: Refactor process_envvars
It splits between process_envvars_secure and process_envvars_default,
with the former used to process arguments for __libc_enable_secure.
It does not have any semantic change, just simplify the code so there
is no need to handle __libc_enable_secure on each len switch.
Checked on x86_64-linux-gnu and aarch64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Wed, 22 Nov 2023 20:43:24 +0000 (17:43 -0300)]
elf: Ignore LD_BIND_NOW and LD_BIND_NOT for setuid binaries
To avoid any environment variable to change setuid binaries
semantics.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Wed, 22 Nov 2023 20:43:23 +0000 (17:43 -0300)]
elf: Ignore loader debug env vars for setuid
Loader already ignores LD_DEBUG, LD_DEBUG_OUTPUT, and
LD_TRACE_LOADED_OBJECTS. Both LD_WARN and LD_VERBOSE are similar to
LD_DEBUG, in the sense they enable additional checks and debug
information, so it makes sense to disable them.
Also add both LD_VERBOSE and LD_WARN on filtered environment variables
for setuid binaries.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Siddhesh Poyarekar [Tue, 5 Dec 2023 14:14:06 +0000 (09:14 -0500)]
Adapt the security policy for the security page
Call the document a "Security Policy" to disambiguate it from the
security *process* documented in the security page. Also, point to the
security page for bug reporting and CVE assignment.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Andreas Schwab [Thu, 23 Nov 2023 17:23:46 +0000 (18:23 +0100)]
aarch64: correct CFI in rawmemchr (bug 31113)
The .cfi_return_column directive changes the return column for the whole
FDE range. But the actual intent is to tell the unwinder that the value
in x30 (lr) now resides in x15 after the move, and that is expressed by
the .cfi_register directive.
Joe Ramsay [Fri, 1 Dec 2023 09:49:45 +0000 (09:49 +0000)]
math: Add new exp10 implementation
New implementation is based on the existing exp/exp2, with different
reduction constants and polynomial. Worst-case error in round-to-
nearest is 0.513 ULP.
The exp/exp2 shared table is reused for exp10 - .rodata size of
e_exp_data increases by 64 bytes.
As for exp/exp2, targets with single-instruction rounding/conversion
intrinsics can use them by toggling TOINT_INTRINSICS=1 and adding the
necessary code to their math_private.h.
Improvements on Neoverse V1 compared to current GLIBC master:
exp10 thruput: 3.3x in [-0x1.439b746e36b52p+8 0x1.34413509f79ffp+8]
exp10 latency: 1.8x in [-0x1.439b746e36b52p+8 0x1.34413509f79ffp+8]
Tested on:
aarch64-linux-gnu (TOINT_INTRINSICS, fma contraction) and
x86_64-linux-gnu (!TOINT_INTRINSICS, no fma contraction)
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Szabolcs Nagy [Mon, 27 Nov 2023 13:15:45 +0000 (13:15 +0000)]
aarch64: fix tested ifunc variants
Don't test a64fx string functions when BTI is enabled since they are
not BTI compatible.
Florian Weimer [Mon, 4 Dec 2023 05:35:56 +0000 (06:35 +0100)]
stdlib: Fix array bounds protection in insertion sort phase of qsort
The previous check did not do anything because tmp_ptr already
points before run_ptr due to the way it is initialized.
Fixes commit
e4d8117b82065dc72e8df80097360e7c05a349b9
("stdlib: Avoid another self-comparison in qsort").
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Samuel Thibault [Sun, 3 Dec 2023 01:06:29 +0000 (02:06 +0100)]
Revert "Update code to handle the new ABI for sending inlined port rights."
This reverts commit
7e23b3c2c008e0b9b5da055e675d40cc27bb10ef.
Samuel Thibault [Sun, 3 Dec 2023 01:06:19 +0000 (02:06 +0100)]
Revert "hurd: Fix build"
This reverts commit
7096914dd8ff2dfd1d8cba3577b72838f5e4c2bd.
Samuel Thibault [Sun, 3 Dec 2023 00:52:58 +0000 (01:52 +0100)]
hurd: Fix build
7e23b3c2c008 ("Update code to handle the new ABI for sending inlined
port rights.") was missing a cast.
Fixes
7e23b3c2c008e0b9b5da055e675d40cc27bb10ef
Flavio Cruz [Fri, 24 Nov 2023 21:30:38 +0000 (16:30 -0500)]
Update code to handle the new ABI for sending inlined port rights.
For i686, this change is no op but for x86_64 it forces all inlined port
rights to be 8 bytes long.
Message-ID: <
20231124213041.952886-2-flaviocruz@gmail.com>
Samuel Thibault [Sat, 2 Dec 2023 20:24:58 +0000 (21:24 +0100)]
hurd: [!__USE_MISC] Do not #undef BSD macros in ioctls
When e.g. including termios.h first and then sys/ioctl.h, without e.g.
_BSD_SOURCE, the latter would #undef e.g. ECHO, without defining it.
Adhemerval Zanella [Thu, 10 Aug 2023 11:56:00 +0000 (08:56 -0300)]
linux: Make fdopendir fail with O_PATH (BZ 30373)
It is not strictly required by the POSIX, since O_PATH is a Linux
extension, but it is QoI to fail early instead of at readdir. Also
the check is free, since fdopendir already checks if the file
descriptor is opened for read.
Checked on x86_64-linux-gnu.
Stefan Liebler [Tue, 21 Nov 2023 12:33:03 +0000 (13:33 +0100)]
Avoid padding in _init and _fini. [BZ #31042]
The linker just concatenates the .init and .fini sections which
results in the complete _init and _fini functions. If needed the
linker adds padding bytes due to an alignment. GNU ld is adding
NOPs, which is fine. But e.g. mold is adding traps which results
in broken _init and _fini functions.
Thus this patch removes the alignment in .init and .fini sections
in crtn.S files.
We keep the 4 byte function alignment in crti.S files. As the
assembler now also outputs the start of _init and _fini functions
as multiples of 4 byte, it perhaps has to fill it. Although GNU as
is using NOPs here, to be sure, we just keep the alignment with
0x07 (=NOPs) at the end of crti.S.
In order to avoid an obvious NOP slide in _fini, this patch also
uses an lg instead of lgr instruction. Then the emitted instructions
needs a multiple of 4 bytes.
Joe Ramsay [Mon, 27 Nov 2023 17:02:55 +0000 (17:02 +0000)]
aarch64: Improve special-case handling in AdvSIMD double-precision libmvec routines
Avoids emitting many saves/restores of vector registers, reduces the
amount of code generated around the scalar fallback.
Adhemerval Zanella [Thu, 23 Nov 2023 17:29:15 +0000 (14:29 -0300)]
malloc: Improve MAP_HUGETLB with glibc.malloc.hugetlb=2
Even for explicit large page support, allocation might use mmap without
the hugepage bit set if the requested size is smaller than
mmap_threshold. For this case where mmap is issued, MAP_HUGETLB is set
iff the allocation size is larger than the used large page.
To force such allocations to use large pages, also tune the mmap_threhold
(if it is not explicit set by a tunable). This forces allocation to
follow the sbrk path, which will fall back to mmap (which will try large
pages before galling back to default mmap).
Checked on x86_64-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
Tested-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Adhemerval Zanella [Thu, 23 Nov 2023 17:29:14 +0000 (14:29 -0300)]
elf: Add a way to check if tunable is set (BZ 27069)
The patch adds two new macros, TUNABLE_GET_DEFAULT and TUNABLE_IS_INITIALIZED,
here the former get the default value with a signature similar to
TUNABLE_GET, while the later returns whether the tunable was set by
the environment variable.
Checked on x86_64-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
Tested-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Noah Goldstein [Wed, 1 Nov 2023 20:30:26 +0000 (15:30 -0500)]
x86: Only align destination to 1x VEC_SIZE in memset 4x loop
Current code aligns to 2x VEC_SIZE. Aligning to 2x has no affect on
performance other than potentially resulting in an additional
iteration of the loop.
1x maintains aligned stores (the only reason to align in this case)
and doesn't incur any unnecessary loop iterations.
Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
Hector Martin [Tue, 28 Nov 2023 06:23:07 +0000 (15:23 +0900)]
elf: Fix TLS modid reuse generation assignment (BZ 29039)
_dl_assign_tls_modid() assigns a slotinfo entry for a new module, but
does *not* do anything to the generation counter. The first time this
happens, the generation is zero and map_generation() returns the current
generation to be used during relocation processing. However, if
a slotinfo entry is later reused, it will already have a generation
assigned. If this generation has fallen behind the current global max
generation, then this causes an obsolete generation to be assigned
during relocation processing, as map_generation() returns this
generation if nonzero. _dl_add_to_slotinfo() eventually resets the
generation, but by then it is too late. This causes DTV updates to be
skipped, leading to NULL or broken TLS slot pointers and segfaults.
Fix this by resetting the generation to zero in _dl_assign_tls_modid(),
so it behaves the same as the first time a slot is assigned.
_dl_add_to_slotinfo() will still assign the correct static generation
later during module load, but relocation processing will no longer use
an obsolete generation.
Note that slotinfo entry (aka modid) reuse typically happens after a
dlclose and only TLS access via dynamic tlsdesc is affected. Because
tlsdesc is optimized to use the optional part of static TLS, dynamic
tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls
tunable to a large enough value, or by LD_PRELOAD-ing the affected
modules.
Fixes bug 29039.
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Tobias Klauser [Tue, 28 Nov 2023 11:06:43 +0000 (12:06 +0100)]
Add TCP_MD5SIG_FLAG_IFINDEX from Linux 5.6 to netinet/tcp.h.
This patch adds the TCP_MD5SIG_FLAG_IFINDEX constant from Linux 5.6 to
sysdeps/gnu/netinet/tcp.h and updates struct tcp_md5sig accordingly to
contain the device index.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Florian Weimer [Mon, 27 Nov 2023 10:28:13 +0000 (11:28 +0100)]
elf: Relocate libc.so early during startup and dlmopen (bug 31083)
This makes it more likely that objects without dependencies can
use IFUNC resolvers in libc.so.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Florian Weimer [Mon, 27 Nov 2023 10:28:10 +0000 (11:28 +0100)]
elf: Introduce the _dl_open_relocate_one_object function
It is extracted from dl_open_worker_begin.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Florian Weimer [Mon, 27 Nov 2023 10:28:07 +0000 (11:28 +0100)]
elf: In _dl_relocate_object, skip processing if object is relocated
This is just a minor optimization. It also makes it more obvious that
_dl_relocate_object can be called multiple times.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Joseph Myers [Thu, 23 Nov 2023 19:01:32 +0000 (19:01 +0000)]
Remove __access_noerrno
A recent commit, apparently commit
6c6fce572fb8f583f14d898e54fd7d25ae91cf56 "elf: Remove /etc/suid-debug
support", resulted in localplt failures for i686-gnu and x86_64-gnu:
Missing required PLT reference: ld.so: __access_noerrno
After that commit, __access_noerrno is actually no longer used at all.
So rather than just removing the localplt expectation for that symbol
for Hurd, completely remove all definitions of and references to that
symbol.
Tested for x86_64, and with build-many-glibcs.py for i686-gnu and
x86_64-gnu.
Adhemerval Zanella [Wed, 11 Oct 2023 16:43:56 +0000 (13:43 -0300)]
malloc: Use __get_nprocs on arena_get2 (BZ 30945)
This restore the 2.33 semantic for arena_get2. It was changed by
11a02b035b46 to avoid arena_get2 call malloc (back when __get_nproc
was refactored to use an scratch_buffer -
903bc7dcc2acafc). The
__get_nproc was refactored over then and now it also avoid to call
malloc.
The
11a02b035b46 did not take in consideration any performance
implication, which should have been discussed properly. The
__get_nprocs_sched is still used as a fallback mechanism if procfs
and sysfs is not acessible.
Checked on x86_64-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
Joe Ramsay [Tue, 21 Nov 2023 14:39:39 +0000 (14:39 +0000)]
aarch64: Fix libmvec benchmarks
These were broken by the new atan2 functions, as they were only
set up for univariate functions. Arity is now detected from the
input file - this revealed a mistake that the double-precision
inputs were being used for both single- and double-precision
routines, which is now remedied.
Florian Weimer [Wed, 22 Nov 2023 07:38:33 +0000 (08:38 +0100)]
posix: Revert the removal of the crypt prototype from <unistd.h>
Many applications still rely on this prototype. Rebuilds without
this prototype result in an implicit function declaration, which can
introduce security vulnerabilities due to 32-bit pointer truncation.
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:50 +0000 (17:25 -0300)]
elf: Add comments on how LD_AUDIT and LD_PRELOAD handle __libc_enable_secure
To make explicit why __libc_enable_secure is not checked.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:49 +0000 (17:25 -0300)]
elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
It mimics the ld.so behavior.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:48 +0000 (17:25 -0300)]
elf: Remove any_debug from dl_main_state
Its usage can be implied by the GLRO(dl_debug_mask).
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:46 +0000 (17:25 -0300)]
elf: Remove LD_PROFILE for static binaries
The _dl_non_dynamic_init does not parse LD_PROFILE, which does not
enable profile for dlopen objects. Since dlopen is deprecated for
static objects, it is better to remove the support.
It also allows to trim down libc.a of profile support.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:45 +0000 (17:25 -0300)]
elf: Ignore LD_PROFILE for setuid binaries
Loader does not ignore LD_PROFILE in secure-execution mode (different
than man-page states [1]), rather it uses a different path
(/var/profile) and ignore LD_PROFILE_OUTPUT.
Allowing secure-execution profiling is already a non good security
boundary, since it enables different code paths and extra OS access by
the process. But by ignoring LD_PROFILE_OUTPUT, the resulting profile
file might also be acceded in a racy manner since the file name does not
use any process-specific information (such as pid, timing, etc.).
Another side-effect is it forces lazy binding even on libraries that
might be with DF_BIND_NOW.
[1] https://man7.org/linux/man-pages/man8/ld.so.8.html
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:43 +0000 (17:25 -0300)]
s390: Use dl-symbol-redir-ifunc.h on cpu-tunables
Using the memcmp symbol directly allows the compile to inline the
memcmp calls (especially because _dl_tunable_set_hwcaps uses constants
values), generating better code.
Checked with tst-tunables on s390x-linux-gnu (qemu system).
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:42 +0000 (17:25 -0300)]
x86: Use dl-symbol-redir-ifunc.h on cpu-tunables
The dl-symbol-redir-ifunc.h redirects compiler-generated libcalls to
arch-specific memory implementations to avoid ifunc calls where it is not
yet possible. The memcmp-isa-default-impl.h aims to fix the same issue
by calling the specific memset implementation directly.
Using the memcmp symbol directly allows the compiler to inline the memset
calls (especially because _dl_tunable_set_hwcaps uses constants values),
generating better code.
Checked on x86_64-linux-gnu.
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:41 +0000 (17:25 -0300)]
elf: Emit warning if tunable is ill-formatted
So caller knows that the tunable will be ignored.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:40 +0000 (17:25 -0300)]
elf: Fix _dl_debug_vdprintf to work before self-relocation
The strlen might trigger and invalid GOT entry if it used before
the process is self-relocated (for instance on dl-tunables if any
error occurs).
For i386, _dl_writev with PIE requires to use the old 'int $0x80'
syscall mode because the calling the TLS register (gs) is not yet
initialized.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:39 +0000 (17:25 -0300)]
elf: Do not parse ill-formatted strings
Instead of ignoring ill-formatted tunable strings, first, check all the
tunable definitions are correct and then set each tunable value. It
means that partially invalid strings, like "key1=value1:key2=key2=value'
or 'key1=value':key2=value2=value2' do not enable 'key1=value1'. It
avoids possible user-defined errors in tunable definitions.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:38 +0000 (17:25 -0300)]
elf: Do not process invalid tunable format
Tunable definitions with more than one '=' on are parsed and enabled,
and any subsequent '=' are ignored. It means that tunables in the form
'tunable=tunable=value' or 'tunable=value=value' are handled as
'tunable=value'. These inputs are likely user input errors, which
should not be accepted.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:37 +0000 (17:25 -0300)]
elf: Add all malloc tunable to unsecvars
Some environment variables allow alteration of allocator behavior
across setuid boundaries, where a setuid program may ignore the
tunable, but its non-setuid child can read it and adjust the memory
allocator behavior accordingly.
Most library behavior tunings is limited to the current process and does
not bleed in scope; so it is unclear how pratical this misfeature is.
If behavior change across privilege boundaries is desirable, it would be
better done with a wrapper program around the non-setuid child that sets
these envvars, instead of using the setuid process as the messenger.
The patch as fixes tst-env-setuid, where it fail if any unsecvars is
set. It also adds a dynamic test, although it requires
--enable-hardcoded-path-in-tests so kernel correctly sets the setuid
bit (using the loader command directly would require to set the
setuid bit on the loader itself, which is not a usual deployment).
Co-authored-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Checked on x86_64-linux-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:36 +0000 (17:25 -0300)]
elf: Ignore GLIBC_TUNABLES for setuid/setgid binaries
The tunable privilege levels were a retrofit to try and keep the malloc
tunable environment variables' behavior unchanged across security
boundaries. However, CVE-2023-4911 shows how tricky can be
tunable parsing in a security-sensitive environment.
Not only parsing, but the malloc tunable essentially changes some
semantics on setuid/setgid processes. Although it is not a direct
security issue, allowing users to change setuid/setgid semantics is not
a good security practice, and requires extra code and analysis to check
if each tunable is safe to use on all security boundaries.
It also means that security opt-in features, like aarch64 MTE, would
need to be explicit enabled by an administrator with a wrapper script
or with a possible future system-wide tunable setting.
Co-authored-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: DJ Delorie <dj@redhat.com>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:35 +0000 (17:25 -0300)]
elf: Add GLIBC_TUNABLES to unsecvars
setuid/setgid process now ignores any glibc tunables, and filters out
all environment variables that might changes its behavior. This patch
also adds GLIBC_TUNABLES, so any spawned process by setuid/setgid
processes should set tunable explicitly.
Checked on x86_64-linux-gnu.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Adhemerval Zanella [Mon, 6 Nov 2023 20:25:34 +0000 (17:25 -0300)]
elf: Remove /etc/suid-debug support
Since malloc debug support moved to a different library
(libc_malloc_debug.so), the glibc.malloc.check requires preloading the
debug library to enable it. It means that suid-debug support has not
been working since 2.34.
To restore its support, it would require to add additional information
and parsing to where to find libc_malloc_debug.so.
It is one thing less that might change AT_SECURE binaries' behavior
due to environment configurations.
Checked on x86_64-linux-gnu.
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Florian Weimer [Tue, 21 Nov 2023 15:45:35 +0000 (16:45 +0100)]
stdlib: The qsort implementation needs to use heapsort in more cases
The existing logic avoided internal stack overflow. To avoid
a denial-of-service condition with adversarial input, it is necessary
to fall over to heapsort if tail-recursing deeply, too, which does
not result in a deep stack of pending partitions.
The new test stdlib/tst-qsort5 is based on Douglas McIlroy's paper
on this subject.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Florian Weimer [Tue, 21 Nov 2023 15:45:35 +0000 (16:45 +0100)]
stdlib: Handle various corner cases in the fallback heapsort for qsort
The previous implementation did not consistently apply the rule that
the child nodes of node K are at 2 * K + 1 and 2 * K + 2, or
that the parent node is at (K - 1) / 2.
Add an internal test that targets the heapsort implementation
directly.
Reported-by: Stepan Golosunov <stepan@golosunov.pp.ru>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Florian Weimer [Tue, 21 Nov 2023 15:45:35 +0000 (16:45 +0100)]
stdlib: Avoid another self-comparison in qsort
In the insertion phase, we could run off the start of the array if the
comparison function never runs zero. In that case, it never finds the
initial element that terminates the iteration.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Samuel Thibault [Mon, 20 Nov 2023 23:55:54 +0000 (00:55 +0100)]
hurd: fix restarting reauth_dtable on signal
While inside the critical section, RPCs would not be restarted, so we
have to handle EINTR errors.
Samuel Thibault [Mon, 20 Nov 2023 18:19:50 +0000 (19:19 +0100)]
hurd: Prevent the final file_exec_paths call from signals
Otherwise if the exec server started thrashing the old task,
we won't be able to restart the exec.
This notably fixes building ghc.
Carlos O'Donell [Mon, 20 Nov 2023 18:15:34 +0000 (13:15 -0500)]
manual: Fix termios.c example. (Bug 31078)
Remove the unused 'char *name;' from the example.
Use write instead of putchar to write input as it is read.
Example tested on x86_64 by compiling and running the example.
Tested by building the manual pdf and reviewing the results.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Joe Ramsay [Thu, 16 Nov 2023 13:24:18 +0000 (13:24 +0000)]
aarch64: Add vector implementations of expm1 routines
May discard sign of 0 - auto tests for -0 and -0x1p-10000 updated accordingly.
Adhemerval Zanella [Thu, 28 Sep 2023 16:56:21 +0000 (13:56 -0300)]
linux: Use fchmodat2 on fchmod for flags different than 0 (BZ 26401)
Linux 6.6 (
09da082b07bbae1c) added support for fchmodat2, which has
similar semantics as fchmodat with an extra flag argument. This
allows fchmodat to implement AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH
without the need for procfs.
The syscall is registered on all architectures (with value of 452
except on alpha which is 562, commit
78252deb023cf087).
The tst-lchmod.c requires a small fix where fchmodat checks two
contradictory assertions ('(st.st_mode & 0777) == 2' and
'(st.st_mode & 0777) == 3').
Checked on x86_64-linux-gnu on a 6.6 kernel.
Reviewed-by: Florian Weimer <fweimer@redhat.com>