commit bdea6c37197a3c9bd976911cce5f580dea1c28dd Author: Andreas K. Hüttel Date: Mon Jul 28 20:35:38 2025 +0200 Replace advisories directory with pointer file Signed-off-by: Andreas K. Hüttel diff --git a/ADVISORIES b/ADVISORIES new file mode 100644 index 0000000000..d4e33f2df3 --- /dev/null +++ b/ADVISORIES @@ -0,0 +1,2 @@ +For the GNU C Library Security Advisories, see the git master branch: +https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 deleted file mode 100644 index 3d19c91b6a..0000000000 --- a/advisories/GLIBC-SA-2023-0001 +++ /dev/null @@ -1,14 +0,0 @@ -printf: incorrect output for integers with thousands separator and width field - -When the printf family of functions is called with a format specifier -that uses an (enable grouping) and a minimum width -specifier, the resulting output could be larger than reasonably expected -by a caller that computed a tight bound on the buffer size. The -resulting larger than expected output could result in a buffer overflow -in the printf family of functions. - -CVE-Id: CVE-2023-25139 -Public-Date: 2023-02-02 -Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) -Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) -Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 deleted file mode 100644 index 5122669a64..0000000000 --- a/advisories/GLIBC-SA-2023-0002 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Stack read overflow in no-aaaa mode - -If the system is configured in no-aaaa mode via /etc/resolv.conf, -getaddrinfo is called for the AF_UNSPEC address family, and a DNS -response is received over TCP that is larger than 2048 bytes, -getaddrinfo may potentially disclose stack contents via the returned -address data, or crash. - -CVE-Id: CVE-2023-4527 -Public-Date: 2023-09-12 -Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) -Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) -Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) -Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) -Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 deleted file mode 100644 index d3aef80348..0000000000 --- a/advisories/GLIBC-SA-2023-0003 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Potential use-after-free - -When an NSS plugin only implements the _gethostbyname2_r and -_getcanonname_r callbacks, getaddrinfo could use memory that was freed -during buffer resizing, potentially causing a crash or read or write to -arbitrary memory. - -CVE-Id: CVE-2023-4806 -Public-Date: 2023-09-12 -Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) -Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 deleted file mode 100644 index 5286a7aa54..0000000000 --- a/advisories/GLIBC-SA-2023-0004 +++ /dev/null @@ -1,16 +0,0 @@ -tunables: local privilege escalation through buffer overflow - -If a tunable of the form NAME=NAME=VAL is passed in the environment of a -setuid program and NAME is valid, it may result in a buffer overflow, -which could be exploited to achieve escalated privileges. This flaw was -introduced in glibc 2.34. - -CVE-Id: CVE-2023-4911 -Public-Date: 2023-10-03 -Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) -Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) -Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) -Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) -Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) -Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) -Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 deleted file mode 100644 index cc4eb90b82..0000000000 --- a/advisories/GLIBC-SA-2023-0005 +++ /dev/null @@ -1,18 +0,0 @@ -getaddrinfo: DoS due to memory leak - -The fix for CVE-2023-4806 introduced a memory leak when an application -calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED -flags set. - -CVE-Id: CVE-2023-5156 -Public-Date: 2023-09-25 -Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) -Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) -Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) -Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) -Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) -Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001 deleted file mode 100644 index 28931c75ae..0000000000 --- a/advisories/GLIBC-SA-2024-0001 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER -containing a long program name failed to update the required buffer -size, leading to the allocation and overflow of a too-small buffer on -the heap. - -CVE-Id: CVE-2023-6246 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39) -Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42) -Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126) diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002 deleted file mode 100644 index 940bfcf2fc..0000000000 --- a/advisories/GLIBC-SA-2024-0002 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal used the return value of snprintf/vsnprintf to -calculate buffer sizes for memory allocation. If these functions (for -any reason) failed and returned -1, the resulting buffer would be too -small to hold output. - -CVE-Id: CVE-2023-6779 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39) -Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43) -Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127) diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003 deleted file mode 100644 index b43a5150ab..0000000000 --- a/advisories/GLIBC-SA-2024-0003 +++ /dev/null @@ -1,13 +0,0 @@ -syslog: Integer overflow in __vsyslog_internal - -__vsyslog_internal calculated a buffer size by adding two integers, but -did not first check if the addition would overflow. - -CVE-Id: CVE-2023-6780 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39) -Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44) -Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128) diff --git a/advisories/GLIBC-SA-2024-0004 b/advisories/GLIBC-SA-2024-0004 deleted file mode 100644 index 08df2b3118..0000000000 --- a/advisories/GLIBC-SA-2024-0004 +++ /dev/null @@ -1,28 +0,0 @@ -ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence - -The iconv() function in the GNU C Library versions 2.39 and older may -overflow the output buffer passed to it by up to 4 bytes when converting -strings to the ISO-2022-CN-EXT character set, which may be used to -crash an application or overwrite a neighbouring variable. - -ISO-2022-CN-EXT uses escape sequences to indicate character set changes -(as specified by RFC 1922). While the SOdesignation has the expected -bounds checks, neither SS2designation nor SS3designation have its; -allowing a write overflow of 1, 2, or 3 bytes with fixed values: -'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. - -CVE-Id: CVE-2024-2961 -Public-Date: 2024-04-17 -Vulnerable-Commit: 755104edc75c53f4a0e7440334e944ad3c6b32fc (2.1.93-169) -Fix-Commit: f9dc609e06b1136bb0408be9605ce7973a767ada (2.40) -Fix-Commit: 31da30f23cddd36db29d5b6a1c7619361b271fb4 (2.39-31) -Fix-Commit: e1135387deded5d73924f6ca20c72a35dc8e1bda (2.38-66) -Fix-Commit: 89ce64b269a897a7780e4c73a7412016381c6ecf (2.37-89) -Fix-Commit: 4ed98540a7fd19f458287e783ae59c41e64df7b5 (2.36-164) -Fix-Commit: 36280d1ce5e245aabefb877fe4d3c6cff95dabfa (2.35-315) -Fix-Commit: a8b0561db4b9847ebfbfec20075697d5492a363c (2.34-459) -Fix-Commit: ed4f16ff6bed3037266f1fa682ebd32a18fce29c (2.33-263) -Fix-Commit: 682ad4c8623e611a971839990ceef00346289cc9 (2.32-140) -Fix-Commit: 3703c32a8d304c1ee12126134ce69be965f38000 (2.31-154) - -Reported-By: Charles Fol diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005 deleted file mode 100644 index a59596610a..0000000000 --- a/advisories/GLIBC-SA-2024-0005 +++ /dev/null @@ -1,22 +0,0 @@ -nscd: Stack-based buffer overflow in netgroup cache - -If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted -by client requests then a subsequent client request for netgroup data -may result in a stack-based buffer overflow. This flaw was introduced -in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33599 -Public-Date: 2024-04-23 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155) -Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141) -Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264) -Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460) -Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316) -Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165) -Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91) -Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72) -Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35) -Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40) diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006 deleted file mode 100644 index d44148d3d9..0000000000 --- a/advisories/GLIBC-SA-2024-0006 +++ /dev/null @@ -1,32 +0,0 @@ -nscd: Null pointer crash after notfound response - -If the Name Service Cache Daemon's (nscd) cache fails to add a not-found -netgroup response to the cache, the client request can result in a null -pointer dereference. This flaw was introduced in glibc 2.15 when the -cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33600 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40) -Fix-Commit: 7835b00dbce53c3c87bbbb1754a95fb5e58187aa (2.40) -Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37) -Fix-Commit: 5a508e0b508c8ad53bd0d2fb48fd71b242626341 (2.39-36) -Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74) -Fix-Commit: 541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a (2.38-73) -Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93) -Fix-Commit: 5eea50c4402e39588de98aa1d4469a79774703d4 (2.37-92) -Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167) -Fix-Commit: c34f470a615b136170abd16142da5dd0c024f7d1 (2.36-166) -Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318) -Fix-Commit: 4370bef52b0f3f3652c6aa13d7a9bb3ac079746d (2.35-317) -Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462) -Fix-Commit: 966d6ac9e40222b84bb21674cc4f83c8d72a5a26 (2.34-461) -Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266) -Fix-Commit: f20a8d696b13c6261b52a6434899121f8b19d5a7 (2.33-265) -Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143) -Fix-Commit: 394eae338199078b7961b051c191539870742d7b (2.32-142) -Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157) -Fix-Commit: 304ce5fe466c4762b21b36c26926a4657b59b53e (2.31-156) diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007 deleted file mode 100644 index b6928fa27a..0000000000 --- a/advisories/GLIBC-SA-2024-0007 +++ /dev/null @@ -1,28 +0,0 @@ -nscd: netgroup cache may terminate daemon on memory allocation failure - -The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or -xrealloc and these functions may terminate the process due to a memory -allocation failure resulting in a denial of service to the clients. The -flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -Subsequent refactoring of the netgroup cache only added more uses of -xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of -nscd only occur during startup of the daemon and so are not affected by -client requests that could trigger an out of memory followed by -termination. - -CVE-Id: CVE-2024-33601 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008 deleted file mode 100644 index d93e2a6f0b..0000000000 --- a/advisories/GLIBC-SA-2024-0008 +++ /dev/null @@ -1,26 +0,0 @@ -nscd: netgroup cache assumes NSS callback uses in-buffer strings - -The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory -when the NSS callback does not store all strings in the provided buffer. -The flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -There is no guarantee from the NSS callback API that the returned -strings are all within the buffer. However, the netgroup cache code -assumes that the NSS callback uses in-buffer strings and if it doesn't -the buffer resizing logic could lead to potential memory corruption. - -CVE-Id: CVE-2024-33602 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2025-0001 b/advisories/GLIBC-SA-2025-0001 deleted file mode 100644 index b053d32e91..0000000000 --- a/advisories/GLIBC-SA-2025-0001 +++ /dev/null @@ -1,40 +0,0 @@ -assert: Buffer overflow when printing assertion failure message - -When the assert() function fails, it does not allocate enough space for the -assertion failure message string and size information, which may lead to a -buffer overflow if the message string size aligns to page size. - -This bug can be triggered when an assertion in a program fails. The assertion -failure message is allocated to allow developers to see this failure in core -dumps and it typically includes, in addition to the invariant assertion -string and function name, the name of the program. If the name of the failing -program is user controlled, for example on a local system, this could allow an -attacker to control the assertion failure to trigger this buffer overflow. - -The only viable vector for exploitation of this bug is local, if a setuid -program exists that has an existing bug that results in an assertion failure. -No such program has been discovered at the time of publishing this advisory, -but the presence of custom setuid programs, although strongly discouraged as a -security practice, cannot be discounted. - -CVE-Id: CVE-2025-0395 -Public-Date: 2025-01-22 -Vulnerable-Commit: f8a3b5bf8fa1d0c43d2458e03cc109a04fdef194 (2.13-175) -Fix-Commit: 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578 (2.41) -Fix-Commit: cdb9ba84191ce72e86346fb8b1d906e7cd930ea2 (2.42) -Fix-Commit: 69fda28279b497bd405fdd442a6d8e4d3d5f681b (2.41-7) -Fix-Commit: 7d4b6bcae91f29d7b4daf15bab06b66cf1d2217c (2.40-66) -Fix-Commit: d6c156c326999f144cb5b73d29982108d549ad8a (2.40-71) -Fix-Commit: 808a84a8b81468b517a4d721fdc62069cb8c211f (2.39-146) -Fix-Commit: f6d48470aef9264d2d56f4c4533eb76db7f9c2e4 (2.39-150) -Fix-Commit: c32fd59314c343db88c3ea4a203870481d33c3d2 (2.38-122) -Fix-Commit: f984e2d7e8299726891a1a497a3c36cd5542a0bf (2.38-124) -Fix-Commit: a3d7865b098a3a67c44f7812208d9ce4718873ba (2.37-143) -Fix-Commit: b989519fe1683c204ac24ec92830e3fe3bfaccad (2.37-146) -Fix-Commit: 7971add7ee4171fdd8dfd17e7c04c4ed77a18845 (2.36-216) -Fix-Commit: 0487893d5c5bc6710d83d7c3152d888a0339559e (2.36-219) -Fix-Commit: 8b5d4be762419c4f6176261c6fea40ac559b88dc (2.35-370) -Fix-Commit: 8b3d09dc0d350191985f9d291cc30ce96f034b49 (2.35-373) -Fix-Commit: df4e1f4a5096b385c9bcc94424cf2eaa227b3761 (2.34-500) -Fix-Commit: 31eb872cb21449832ab47ad5db83281d240e1d03 (2.34-503) -Reported-By: Qualys Security Advisory diff --git a/advisories/GLIBC-SA-2025-0002 b/advisories/GLIBC-SA-2025-0002 deleted file mode 100644 index 161da13dd4..0000000000 --- a/advisories/GLIBC-SA-2025-0002 +++ /dev/null @@ -1,23 +0,0 @@ -elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH - -A statically linked setuid binary that calls dlopen (including internal -dlopen calls after setlocale or calls to NSS functions such as getaddrinfo) -may incorrectly search LD_LIBRARY_PATH to determine which library to load, -leading to the execution of library code that is attacker controlled. - -The only viable vector for exploitation of this bug is local, if a static -setuid program exists, and that program calls dlopen, then it may search -LD_LIBRARY_PATH to locate the SONAME to load. No such program has been -discovered at the time of publishing this advisory, but the presence of -custom setuid programs, although strongly discouraged as a security -practice, cannot be discounted. - -CVE-Id: CVE-2025-4802 -Public-Date: 2025-05-16 -Vulnerable-Commit: 10e93d968716ab82931d593bada121c17c0a4b93 (2.27) -Fix-Commit: 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 (2.39) -Fix-Commit: 3be3728df2f1912c80abd3288bc6e3a25ad679e4 (2.38-132) -Fix-Commit: 7403ede2d7752e59e0c47d5d33d73c2bf850e7be (2.37-154) -Fix-Commit: 2ef7850279b2931caf6d6d6743ebaa91839e1cf7 (2.36-227) -Fix-Commit: 621c65ccf12ddd415ceeb2234423bd1acd0fabb3 (2.35-387) -Fix-Commit: 35018c0fd20eac9ceaf60060fed2745b3177359d (2.34-517) diff --git a/advisories/GLIBC-SA-2025-0003 b/advisories/GLIBC-SA-2025-0003 deleted file mode 100644 index 2adeb3ce00..0000000000 --- a/advisories/GLIBC-SA-2025-0003 +++ /dev/null @@ -1,30 +0,0 @@ -power10: strcmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strcmp in -sysdeps/powerpc/powerpc64/le/power10/strcmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strcmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strcmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5702 -Public-Date: 2025-06-04 -Vulnerable-Commit: 3367d8e180848030d1646f088759f02b8dfe0d6f (2.39) -Fix-Commit: 15808c77b35319e67ee0dc8f984a9a1a434701bc (2.42) -Fix-Commit: 0c76c951620f9e12df2a89b2c684878b55bb6795 (2.41-60) -Fix-Commit: 7e12550b8e3a11764a4a9090ce6bd3fc23fc8a8e (2.40-139) -Fix-Commit: 06a70769fd0b2e1f2a3085ad50ab620282bd77b3 (2.39-209) diff --git a/advisories/GLIBC-SA-2025-0004 b/advisories/GLIBC-SA-2025-0004 deleted file mode 100644 index 9409ca27c4..0000000000 --- a/advisories/GLIBC-SA-2025-0004 +++ /dev/null @@ -1,29 +0,0 @@ -power10: strncmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strncmp in -sysdeps/powerpc/powerpc64/le/power10/strncmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strncmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strncmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5745 -Public-Date: 2025-06-05 -Vulnerable-Commit: 23f0d81608d0ca6379894ef81670cf30af7fd081 (2.40) -Fix-Commit: 63c60101ce7c5eac42be90f698ba02099b41b965 (2.42) -Fix-Commit: 84bdbf8a6f2fdafd3661489dbb7f79835a52da82 (2.41-57) -Fix-Commit: 42a5a940c974d02540c8da26d6374c744d148cb9 (2.40-136) diff --git a/advisories/GLIBC-SA-2025-0005 b/advisories/GLIBC-SA-2025-0005 deleted file mode 100644 index 8bcccc59a5..0000000000 --- a/advisories/GLIBC-SA-2025-0005 +++ /dev/null @@ -1,14 +0,0 @@ -posix: Fix double-free after allocation failure in regcomp - -The regcomp function in the GNU C library version from 2.4 to 2.41 is -subject to a double free if some previous allocation fails. It can be -accomplished either by a malloc failure or by using an interposed -malloc that injects random malloc failures. The double free can allow -buffer manipulation depending of how the regex is constructed. -This issue affects all architectures and ABIs supported by the GNU C -library. - -CVE-Id: CVE-2025-8058 -Public-Date: 2025-07-22 -Vulnerable-Commit: 963d8d782fc98fb6dc3a66f0068795f9920c269d (2.3.3-1596) -Fix-Commit: 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d (2.42) diff --git a/advisories/README b/advisories/README deleted file mode 100644 index b8f8a829ca..0000000000 --- a/advisories/README +++ /dev/null @@ -1,77 +0,0 @@ -GNU C Library Security Advisory Format -====================================== - -Security advisories in this directory follow a simple git commit log -format, with a heading and free-format description augmented with tags -to allow parsing key information. References to code changes are -specific to the glibc repository and follow a specific format: - - Tag-name: (release-version) - -The indicates a specific commit in the repository. The -release-version indicates the publicly consumable release in which this -commit is known to exist. The release-version is derived from the -git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and -is of the form 2.34-NNN. If the -NNN suffix is absent, it means that -the change is in that release tarball, otherwise the change is on the -release/2.YY/master branch and not in any released tarball. - -The following tags are currently being used: - -CVE-Id: -This is the CVE-Id assigned under the CVE Program -(https://www.cve.org/). - -Public-Date: -The date this issue became publicly known. - -Vulnerable-Commit: -The commit that introduced this vulnerability. There could be multiple -entries, one for each release branch in the glibc repository; the -release-version portion of this tag should tell you which branch this is -on. - -Fix-Commit: -The commit that fixed this vulnerability. There could be multiple -entries for each release branch in the glibc repository, indicating that -all of those commits contributed to fixing that issue in each of those -branches. - -Reported-By: -The entity that reported this issue. There could be multiple entries, one for -each reporter. - -Adding an Advisory ------------------- - -An advisory for a CVE needs to be added on the master branch in two steps: - -1. Add the text of the advisory without any Fix-Commit tags along with - the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. - The advisories directory does not exist in release branches, so keep - the advisory text commit distinct from the code changes, to ease - backports. Ask for the GLIBC-SA advisory number from the security - team. - -2. Finish all backports on release branches and then back on the msater - branch, add all commit refs to the advisory using the Fix-Commit - tags. Don't bother adding the release-version subscript since the - next step will overwrite it. - -3. Run the process-advisories.sh script in the scripts directory on the - advisory: - - scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN - - (replace YYYY-NNNN with the actual advisory number). - -4. Verify the updated advisory and push the result. - -Getting a NEWS snippet from advisories --------------------------------------- - -Run: - - scripts/process-advisories.sh news - -and copy the content into the NEWS file. commit 3ec4dd77f648da031bba4d3fa14825e057b5a40d Author: Andreas K. Hüttel Date: Mon Jul 28 23:39:48 2025 +0200 NEWS: add new section Signed-off-by: Andreas K. Hüttel diff --git a/NEWS b/NEWS index f0b0e924a4..9cb8de11f9 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,12 @@ See the end for copying conditions. Please send GNU C library bug reports via using `glibc' in the "product" field. +Version 2.42.1 + +The following bugs were resolved with this release: + + [insert bugs here] + Version 2.42 Major new features: commit bc13db73937730401d592b33092db6df806d193e Author: Sam James Date: Mon Jul 28 21:55:30 2025 +0100 inet-fortified: fix namespace violation (bug 33227) We need to use __sz, not sz, as we do elsewhere. Reviewed-by: Florian Weimer (cherry picked from commit 87afbd7a1ad9c1dd116921817fa97198171045db) diff --git a/inet/bits/inet-fortified.h b/inet/bits/inet-fortified.h index 6738221a54..cc476ebcfd 100644 --- a/inet/bits/inet-fortified.h +++ b/inet/bits/inet-fortified.h @@ -45,15 +45,15 @@ __NTH (inet_pton (int __af, __fortify_clang_warning_only_if_bos0_lt (4, __dst, "inet_pton called with destination buffer size less than 4") { - size_t sz = 0; + size_t __sz = 0; if (__af == AF_INET) - sz = sizeof (struct in_addr); + __sz = sizeof (struct in_addr); else if (__af == AF_INET6) - sz = sizeof (struct in6_addr); + __sz = sizeof (struct in6_addr); else return __inet_pton_alias (__af, __src, __dst); - return __glibc_fortify (inet_pton, sz, sizeof (char), + return __glibc_fortify (inet_pton, __sz, sizeof (char), __glibc_objsize (__dst), __af, __src, __dst); }; commit fd18059c0fcf5568db3688da47403b663cf91c5e Author: Davide Cavalca Date: Thu Jul 31 17:32:58 2025 +0200 stdlib: resolve a double lock init issue after fork [BZ #32994] The __abort_fork_reset_child (introduced in d40ac01cbbc66e6d9dbd8e3485605c63b2178251) call resets the lock after the fork. This causes a DRD regression in valgrind (https://bugs.kde.org/show_bug.cgi?id=503668), as it's effectively a double initialization, despite it being actually ok in this case. As suggested in https://sourceware.org/bugzilla/show_bug.cgi?id=32994#c2 we replace it here with a memcpy of another initialized lock instead, which makes valgrind happy. Reviewed-by: Florian Weimer (cherry picked from commit d9a348d0927c7a1aec5caf3df3fcd36956b3eb23) diff --git a/NEWS b/NEWS index 9cb8de11f9..4610b8bbc6 100644 --- a/NEWS +++ b/NEWS @@ -9,7 +9,7 @@ Version 2.42.1 The following bugs were resolved with this release: - [insert bugs here] + [32994] stdlib: resolve a double lock init issue after fork Version 2.42 diff --git a/stdlib/abort.c b/stdlib/abort.c index caa9e6dc04..904244a2fb 100644 --- a/stdlib/abort.c +++ b/stdlib/abort.c @@ -19,6 +19,7 @@ #include #include #include +#include #include /* Try to get a machine dependent instruction which will make the @@ -42,7 +43,10 @@ __libc_rwlock_define_initialized (static, lock); void __abort_fork_reset_child (void) { - __libc_rwlock_init (lock); + /* Reinitialize lock without calling pthread_rwlock_init, to + avoid a valgrind DRD false positive. */ + __libc_rwlock_define_initialized (, reset_lock); + memcpy (&lock, &reset_lock, sizeof (lock)); } void commit 2fadee530155bae6682ab2965d6ff3a2fc9eced6 Author: Florian Weimer Date: Fri Aug 1 19:27:04 2025 +0200 elf: Extract rtld_setup_phdr function from dl_main Remove historic binutils reference from comment and update how this data is used by applications. Reviewed-by: Adhemerval Zanella (cherry picked from commit 2cac9559e06044ba520e785c151fbbd25011865f) diff --git a/elf/rtld.c b/elf/rtld.c index 493f9696ea..6fb900fb31 100644 --- a/elf/rtld.c +++ b/elf/rtld.c @@ -1239,6 +1239,37 @@ rtld_setup_main_map (struct link_map *main_map) return has_interp; } +/* Set up the program header information for the dynamic linker + itself. It can be accessed via _r_debug and dl_iterate_phdr + callbacks. */ +static void +rtld_setup_phdr (void) +{ + /* Starting from binutils-2.23, the linker will define the magic + symbol __ehdr_start to point to our own ELF header if it is + visible in a segment that also includes the phdrs. */ + + const ElfW(Ehdr) *rtld_ehdr = &__ehdr_start; + assert (rtld_ehdr->e_ehsize == sizeof *rtld_ehdr); + assert (rtld_ehdr->e_phentsize == sizeof (ElfW(Phdr))); + + const ElfW(Phdr) *rtld_phdr = (const void *) rtld_ehdr + rtld_ehdr->e_phoff; + + _dl_rtld_map.l_phdr = rtld_phdr; + _dl_rtld_map.l_phnum = rtld_ehdr->e_phnum; + + + /* PT_GNU_RELRO is usually the last phdr. */ + size_t cnt = rtld_ehdr->e_phnum; + while (cnt-- > 0) + if (rtld_phdr[cnt].p_type == PT_GNU_RELRO) + { + _dl_rtld_map.l_relro_addr = rtld_phdr[cnt].p_vaddr; + _dl_rtld_map.l_relro_size = rtld_phdr[cnt].p_memsz; + break; + } +} + /* Adjusts the contents of the stack and related globals for the user entry point. The ld.so processed skip_args arguments and bumped _dl_argv and _dl_argc accordingly. Those arguments are removed from @@ -1705,33 +1736,7 @@ dl_main (const ElfW(Phdr) *phdr, ++GL(dl_ns)[LM_ID_BASE]._ns_nloaded; ++GL(dl_load_adds); - /* Starting from binutils-2.23, the linker will define the magic symbol - __ehdr_start to point to our own ELF header if it is visible in a - segment that also includes the phdrs. If that's not available, we use - the old method that assumes the beginning of the file is part of the - lowest-addressed PT_LOAD segment. */ - - /* Set up the program header information for the dynamic linker - itself. It is needed in the dl_iterate_phdr callbacks. */ - const ElfW(Ehdr) *rtld_ehdr = &__ehdr_start; - assert (rtld_ehdr->e_ehsize == sizeof *rtld_ehdr); - assert (rtld_ehdr->e_phentsize == sizeof (ElfW(Phdr))); - - const ElfW(Phdr) *rtld_phdr = (const void *) rtld_ehdr + rtld_ehdr->e_phoff; - - _dl_rtld_map.l_phdr = rtld_phdr; - _dl_rtld_map.l_phnum = rtld_ehdr->e_phnum; - - - /* PT_GNU_RELRO is usually the last phdr. */ - size_t cnt = rtld_ehdr->e_phnum; - while (cnt-- > 0) - if (rtld_phdr[cnt].p_type == PT_GNU_RELRO) - { - _dl_rtld_map.l_relro_addr = rtld_phdr[cnt].p_vaddr; - _dl_rtld_map.l_relro_size = rtld_phdr[cnt].p_memsz; - break; - } + rtld_setup_phdr (); /* Add the dynamic linker to the TLS list if it also uses TLS. */ if (_dl_rtld_map.l_tls_blocksize != 0) commit 5e298d2d937b6da06500478be956abeb24357e05 Author: Florian Weimer Date: Fri Aug 1 19:27:35 2025 +0200 elf: Handle ld.so with LOAD segment gaps in _dl_find_object (bug 31943) Detect if ld.so not contiguous and handle that case in _dl_find_object. Set l_find_object_processed even for initially loaded link maps, otherwise dlopen of an initially loaded object adds it to _dlfo_loaded_mappings (where maps are expected to be contiguous), in addition to _dlfo_nodelete_mappings. Test elf/tst-link-map-contiguous-ldso iterates over the loader image, reading every word to make sure memory is actually mapped. It only does that if the l_contiguous flag is set for the link map. Otherwise, it finds gaps with mmap and checks that _dl_find_object does not return the ld.so mapping for them. The test elf/tst-link-map-contiguous-main does the same thing for the libc.so shared object. This only works if the kernel loaded the main program because the glibc dynamic loader may fill the gaps with PROT_NONE mappings in some cases, making it contiguous, but accesses to individual words may still fault. Test elf/tst-link-map-contiguous-libc is again slightly different because the dynamic loader always fills the gaps with PROT_NONE mappings, so a different form of probing has to be used. Reviewed-by: Adhemerval Zanella (cherry picked from commit 20681be149b9eb1b6c1f4246bf4bd801221c86cd) diff --git a/NEWS b/NEWS index 4610b8bbc6..cbe11ac95b 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,7 @@ Version 2.42.1 The following bugs were resolved with this release: + [31943] _dl_find_object can fail if ld.so contains gaps between load segments [32994] stdlib: resolve a double lock init issue after fork Version 2.42 diff --git a/elf/Makefile b/elf/Makefile index 48aa0b57e5..3a5596e2bb 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -543,6 +543,8 @@ tests-internal += \ tst-dl_find_object-threads \ tst-dlmopen2 \ tst-hash-collision3 \ + tst-link-map-contiguous-ldso \ + tst-link-map-contiguous-libc \ tst-ptrguard1 \ tst-stackguard1 \ tst-tls-surplus \ @@ -554,6 +556,10 @@ tests-internal += \ unload2 \ # tests-internal +ifeq ($(build-hardcoded-path-in-tests),yes) +tests-internal += tst-link-map-contiguous-main +endif + tests-container += \ tst-dlopen-self-container \ tst-dlopen-tlsmodid-container \ diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c index 1e76373292..c9f4c1c8d1 100644 --- a/elf/dl-find_object.c +++ b/elf/dl-find_object.c @@ -465,6 +465,37 @@ _dl_find_object (void *pc1, struct dl_find_object *result) } rtld_hidden_def (_dl_find_object) +/* Subroutine of _dlfo_process_initial to split out noncontigous link + maps. NODELETE is the number of used _dlfo_nodelete_mappings + elements. It is incremented as needed, and the new NODELETE value + is returned. */ +static size_t +_dlfo_process_initial_noncontiguous_map (struct link_map *map, + size_t nodelete) +{ + struct dl_find_object_internal dlfo; + _dl_find_object_from_map (map, &dlfo); + + /* PT_LOAD segments for a non-contiguous link map are added to the + non-closeable mappings. */ + const ElfW(Phdr) *ph = map->l_phdr; + const ElfW(Phdr) *ph_end = map->l_phdr + map->l_phnum; + for (; ph < ph_end; ++ph) + if (ph->p_type == PT_LOAD) + { + if (_dlfo_nodelete_mappings != NULL) + { + /* Second pass only. */ + _dlfo_nodelete_mappings[nodelete] = dlfo; + ElfW(Addr) start = ph->p_vaddr + map->l_addr; + _dlfo_nodelete_mappings[nodelete].map_start = start; + _dlfo_nodelete_mappings[nodelete].map_end = start + ph->p_memsz; + } + ++nodelete; + } + return nodelete; +} + /* _dlfo_process_initial is called twice. First to compute the array sizes from the initial loaded mappings. Second to fill in the bases and infos arrays with the (still unsorted) data. Returns the @@ -476,29 +507,8 @@ _dlfo_process_initial (void) size_t nodelete = 0; if (!main_map->l_contiguous) - { - struct dl_find_object_internal dlfo; - _dl_find_object_from_map (main_map, &dlfo); - - /* PT_LOAD segments for a non-contiguous are added to the - non-closeable mappings. */ - for (const ElfW(Phdr) *ph = main_map->l_phdr, - *ph_end = main_map->l_phdr + main_map->l_phnum; - ph < ph_end; ++ph) - if (ph->p_type == PT_LOAD) - { - if (_dlfo_nodelete_mappings != NULL) - { - /* Second pass only. */ - _dlfo_nodelete_mappings[nodelete] = dlfo; - _dlfo_nodelete_mappings[nodelete].map_start - = ph->p_vaddr + main_map->l_addr; - _dlfo_nodelete_mappings[nodelete].map_end - = _dlfo_nodelete_mappings[nodelete].map_start + ph->p_memsz; - } - ++nodelete; - } - } + /* Contiguous case already handled in _dl_find_object_init. */ + nodelete = _dlfo_process_initial_noncontiguous_map (main_map, nodelete); size_t loaded = 0; for (Lmid_t ns = 0; ns < GL(dl_nns); ++ns) @@ -510,11 +520,18 @@ _dlfo_process_initial (void) /* lt_library link maps are implicitly NODELETE. */ if (l->l_type == lt_library || l->l_nodelete_active) { - if (_dlfo_nodelete_mappings != NULL) - /* Second pass only. */ - _dl_find_object_from_map - (l, _dlfo_nodelete_mappings + nodelete); - ++nodelete; + /* The kernel may have loaded ld.so with gaps. */ + if (!l->l_contiguous && is_rtld_link_map (l)) + nodelete + = _dlfo_process_initial_noncontiguous_map (l, nodelete); + else + { + if (_dlfo_nodelete_mappings != NULL) + /* Second pass only. */ + _dl_find_object_from_map + (l, _dlfo_nodelete_mappings + nodelete); + ++nodelete; + } } else if (l->l_type == lt_loaded) { @@ -764,7 +781,6 @@ _dl_find_object_update_1 (struct link_map **loaded, size_t count) /* Prefer newly loaded link map. */ assert (loaded_index1 > 0); _dl_find_object_from_map (loaded[loaded_index1 - 1], dlfo); - loaded[loaded_index1 - 1]->l_find_object_processed = 1; --loaded_index1; } diff --git a/elf/dl-find_object.h b/elf/dl-find_object.h index 9aa2439eaa..d9d75c4ad9 100644 --- a/elf/dl-find_object.h +++ b/elf/dl-find_object.h @@ -94,7 +94,7 @@ _dl_find_object_to_external (struct dl_find_object_internal *internal, } /* Extract the object location data from a link map and writes it to - *RESULT using relaxed MO stores. */ + *RESULT using relaxed MO stores. Set L->l_find_object_processed. */ static void __attribute__ ((unused)) _dl_find_object_from_map (struct link_map *l, struct dl_find_object_internal *result) @@ -141,8 +141,11 @@ _dl_find_object_from_map (struct link_map *l, break; } if (read_seg == 3) - return; + goto done; } + + done: + l->l_find_object_processed = 1; } /* Called by the dynamic linker to set up the data structures for the diff --git a/elf/rtld.c b/elf/rtld.c index 6fb900fb31..ef4d96c053 100644 --- a/elf/rtld.c +++ b/elf/rtld.c @@ -1241,7 +1241,7 @@ rtld_setup_main_map (struct link_map *main_map) /* Set up the program header information for the dynamic linker itself. It can be accessed via _r_debug and dl_iterate_phdr - callbacks. */ + callbacks, and it is used by _dl_find_object. */ static void rtld_setup_phdr (void) { @@ -1259,6 +1259,29 @@ rtld_setup_phdr (void) _dl_rtld_map.l_phnum = rtld_ehdr->e_phnum; + _dl_rtld_map.l_contiguous = 1; + /* The linker may not have produced a contiguous object. The kernel + will load the object with actual gaps (unlike the glibc loader + for shared objects, which always produces a contiguous mapping). + See similar logic in rtld_setup_main_map above. */ + { + ElfW(Addr) expected_load_address = 0; + for (const ElfW(Phdr) *ph = rtld_phdr; ph < &rtld_phdr[rtld_ehdr->e_phnum]; + ++ph) + if (ph->p_type == PT_LOAD) + { + ElfW(Addr) mapstart = ph->p_vaddr & ~(GLRO(dl_pagesize) - 1); + if (_dl_rtld_map.l_contiguous && expected_load_address != 0 + && expected_load_address != mapstart) + _dl_rtld_map.l_contiguous = 0; + ElfW(Addr) allocend = ph->p_vaddr + ph->p_memsz; + /* The next expected address is the page following this load + segment. */ + expected_load_address = ((allocend + GLRO(dl_pagesize) - 1) + & ~(GLRO(dl_pagesize) - 1)); + } + } + /* PT_GNU_RELRO is usually the last phdr. */ size_t cnt = rtld_ehdr->e_phnum; while (cnt-- > 0) diff --git a/elf/tst-link-map-contiguous-ldso.c b/elf/tst-link-map-contiguous-ldso.c new file mode 100644 index 0000000000..04de808bb2 --- /dev/null +++ b/elf/tst-link-map-contiguous-ldso.c @@ -0,0 +1,98 @@ +/* Check that _dl_find_object behavior matches up with gaps. + Copyright (C) 2025 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static int +do_test (void) +{ + struct link_map *l = xdlopen (LD_SO, RTLD_NOW); + if (!l->l_contiguous) + { + puts ("info: ld.so link map is not contiguous"); + + /* Try to find holes by probing with mmap. */ + int pagesize = getpagesize (); + bool gap_found = false; + ElfW(Addr) addr = l->l_map_start; + TEST_COMPARE (addr % pagesize, 0); + while (addr < l->l_map_end) + { + void *expected = (void *) addr; + void *ptr = xmmap (expected, 1, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, -1); + struct dl_find_object dlfo; + int dlfo_ret = _dl_find_object (expected, &dlfo); + if (ptr == expected) + { + if (dlfo_ret < 0) + { + TEST_COMPARE (dlfo_ret, -1); + printf ("info: hole without mapping data found at %p\n", ptr); + } + else + FAIL ("object \"%s\" found in gap at %p", + dlfo.dlfo_link_map->l_name, ptr); + gap_found = true; + } + else if (dlfo_ret == 0) + { + if ((void *) dlfo.dlfo_link_map != (void *) l) + { + printf ("info: object \"%s\" found at %p\n", + dlfo.dlfo_link_map->l_name, ptr); + gap_found = true; + } + } + else + TEST_COMPARE (dlfo_ret, -1); + xmunmap (ptr, 1); + addr += pagesize; + } + if (!gap_found) + FAIL ("no ld.so gap found"); + } + else + { + puts ("info: ld.so link map is contiguous"); + + /* Assert that ld.so is truly contiguous in memory. */ + volatile long int *p = (volatile long int *) l->l_map_start; + volatile long int *end = (volatile long int *) l->l_map_end; + while (p < end) + { + *p; + ++p; + } + } + + xdlclose (l); + + return 0; +} + +#include diff --git a/elf/tst-link-map-contiguous-libc.c b/elf/tst-link-map-contiguous-libc.c new file mode 100644 index 0000000000..eb5728c765 --- /dev/null +++ b/elf/tst-link-map-contiguous-libc.c @@ -0,0 +1,57 @@ +/* Check that the entire libc.so program image is readable if contiguous. + Copyright (C) 2025 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include + +static int +do_test (void) +{ + struct link_map *l = xdlopen (LIBC_SO, RTLD_NOW); + + /* The dynamic loader fills holes with PROT_NONE mappings. */ + if (!l->l_contiguous) + FAIL_EXIT1 ("libc.so link map is not contiguous"); + + /* Direct probing does not work because not everything is readable + due to PROT_NONE mappings. */ + int pagesize = getpagesize (); + ElfW(Addr) addr = l->l_map_start; + TEST_COMPARE (addr % pagesize, 0); + while (addr < l->l_map_end) + { + void *expected = (void *) addr; + void *ptr = xmmap (expected, 1, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, -1); + if (ptr == expected) + FAIL ("hole in libc.so memory image after %lu bytes", + (unsigned long int) (addr - l->l_map_start)); + xmunmap (ptr, 1); + addr += pagesize; + } + + xdlclose (l); + + return 0; +} +#include diff --git a/elf/tst-link-map-contiguous-main.c b/elf/tst-link-map-contiguous-main.c new file mode 100644 index 0000000000..2d1a054f0f --- /dev/null +++ b/elf/tst-link-map-contiguous-main.c @@ -0,0 +1,45 @@ +/* Check that the entire main program image is readable if contiguous. + Copyright (C) 2025 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include + +static int +do_test (void) +{ + struct link_map *l = xdlopen ("", RTLD_NOW); + if (!l->l_contiguous) + FAIL_UNSUPPORTED ("main link map is not contiguous"); + + /* This check only works if the kernel loaded the main program. The + dynamic loader replaces gaps with PROT_NONE mappings, resulting + in faults. */ + volatile long int *p = (volatile long int *) l->l_map_start; + volatile long int *end = (volatile long int *) l->l_map_end; + while (p < end) + { + *p; + ++p; + } + + xdlclose (l); + + return 0; +} +#include commit b38f3f60d5b157edcf4d8bd1fd3ed02d417889e0 Author: Adhemerval Zanella Date: Fri Aug 1 15:00:25 2025 -0300 nptl: Fix SYSCALL_CANCEL for return values larger than INT_MAX (BZ 33245) The SYSCALL_CANCEL calls __syscall_cancel, which in turn calls __internal_syscall_cancel with an 'int' return instead of the expected 'long int'. This causes issues with syscalls that return values larger than INT_MAX, such as copy_file_range [1]. Checked on x86_64-linux-gnu. [1] https://debbugs.gnu.org/cgi/bugreport.cgi?bug=79139 Reviewed-by: Andreas K. Huettel (cherry picked from commit 7107bebf19286f42dcb0a97581137a5893c16206) diff --git a/NEWS b/NEWS index cbe11ac95b..1d04bdfef8 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ The following bugs were resolved with this release: [31943] _dl_find_object can fail if ld.so contains gaps between load segments [32994] stdlib: resolve a double lock init issue after fork + [33245] nptl: nptl: error in internal cancellation syscall handling Version 2.42 diff --git a/nptl/cancellation.c b/nptl/cancellation.c index 156e63dcf0..bed0383a23 100644 --- a/nptl/cancellation.c +++ b/nptl/cancellation.c @@ -72,8 +72,8 @@ __syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, __syscall_arg_t a5, __syscall_arg_t a6, __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr) { - int r = __internal_syscall_cancel (a1, a2, a3, a4, a5, a6, - __SYSCALL_CANCEL7_ARG nr); + long int r = __internal_syscall_cancel (a1, a2, a3, a4, a5, a6, + __SYSCALL_CANCEL7_ARG nr); return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r)) ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r)) : r; commit 9d5bf9c17db0f35268cd798660c8bbeea1f4071d Author: H.J. Lu Date: Sat Jul 19 07:43:26 2025 -0700 Delete temporary files in support_subprocess Call support_delete_temp_files to delete temporary files before exit in support_subprocess. This partially fixes BZ #33182. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella (cherry picked from commit d27b1a71cd424710813bd3d81afb32a36470d643) diff --git a/support/support_subprocess.c b/support/support_subprocess.c index be00dde3a7..8bf9a33ea2 100644 --- a/support/support_subprocess.c +++ b/support/support_subprocess.c @@ -25,6 +25,7 @@ #include #include #include +#include static struct support_subprocess support_subprocess_init (void) @@ -60,6 +61,8 @@ support_subprocess (void (*callback) (void *), void *closure) xclose (result.stdout_pipe[1]); xclose (result.stderr_pipe[1]); callback (closure); + /* Make sure that temporary files are deleted. */ + support_delete_temp_files (); _exit (0); } xclose (result.stdout_pipe[1]); commit 9ec7a532ffdb9a6e0a4b220d7a694d6120701035 Author: H.J. Lu Date: Sat Jul 19 07:43:27 2025 -0700 tst-fopen-threaded.c: Delete temporary file Update tst-fopen-threaded.c to call support_create_temp_directory to create a temporary directory and open "file" in the temporary directory, instead of using /tmp/openclosetest and leaving it behind. This partially fixes BZ #33182. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella (cherry picked from commit e7db5150603bb2224a2bfd9628cae04ddcbe49e3) diff --git a/sysdeps/pthread/tst-fopen-threaded.c b/sysdeps/pthread/tst-fopen-threaded.c index ade58ad19e..c17f1eaa13 100644 --- a/sysdeps/pthread/tst-fopen-threaded.c +++ b/sysdeps/pthread/tst-fopen-threaded.c @@ -34,11 +34,13 @@ #include #include #include +#include #include #include #include #include +#include #define NUM_THREADS 100 #define ITERS 10 @@ -111,7 +113,8 @@ threadOpenCloseRoutine (void *argv) /* Wait for all threads to be ready to call fopen and fclose. */ xpthread_barrier_wait (&barrier); - FILE *fd = xfopen ("/tmp/openclosetest", "w+"); + char *file = (char *) argv; + FILE *fd = xfopen (file, "w+"); xfclose (fd); return NULL; } @@ -235,6 +238,10 @@ do_test (void) xfclose (fd_file); } + char *tempdir = support_create_temp_directory ("openclosetest-"); + char *file = xasprintf ("%s/file", tempdir); + add_temp_file (file); + /* Test 3: Concurrent open/close. */ for (int reps = 1; reps <= ITERS; reps++) { @@ -243,7 +250,7 @@ do_test (void) { threads[i] = xpthread_create (support_small_stack_thread_attribute (), - threadOpenCloseRoutine, NULL); + threadOpenCloseRoutine, file); } for (int i = 0; i < NUM_THREADS; i++) { @@ -252,6 +259,9 @@ do_test (void) xpthread_barrier_destroy (&barrier); } + free (file); + free (tempdir); + return 0; } commit 41a77b78cff821007e3dd874619ebec7ce708c3d Author: H.J. Lu Date: Sat Jul 19 07:43:28 2025 -0700 tst-freopen4-main.c: Call support_capture_subprocess with chroot Update tst-freopen4-main.c to call support_capture_subprocess with chroot, which makes temporary files inaccessible, so that temporary files can be deleted. This partially fixes BZ #33182. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella (cherry picked from commit 6463d4a7b28e5ee3891c34a8a1f0a59c24dfa9de) diff --git a/stdio-common/tst-freopen4-main.c b/stdio-common/tst-freopen4-main.c index 3336f5327d..436da4d203 100644 --- a/stdio-common/tst-freopen4-main.c +++ b/stdio-common/tst-freopen4-main.c @@ -28,25 +28,15 @@ #include #include #include +#include -int -do_test (void) +static void +do_test_chroot (void *data) { - mtrace (); - char *temp_dir; + char *temp_dir = (char *) data; FILE *fp; int ret; - /* These chroot tests verify that either reopening a renamed or - deleted file works even in the absence of /proc, or that it fails - (without memory leaks); thus, for example, such reopening does - not crash in the absence of /proc. */ - - support_become_root (); - if (!support_can_chroot ()) - return EXIT_UNSUPPORTED; - - temp_dir = support_create_temp_directory ("tst-freopen4"); xchroot (temp_dir); /* Test freopen with NULL, renamed file. This verifies that @@ -96,6 +86,32 @@ do_test (void) puts ("freopen of deleted file failed (OK)"); free (temp_dir); +} + +int +do_test (void) +{ + mtrace (); + char *temp_dir; + + /* These chroot tests verify that either reopening a renamed or + deleted file works even in the absence of /proc, or that it fails + (without memory leaks); thus, for example, such reopening does + not crash in the absence of /proc. */ + + support_become_root (); + if (!support_can_chroot ()) + return EXIT_UNSUPPORTED; + + temp_dir = support_create_temp_directory ("tst-freopen4"); + + struct support_capture_subprocess result; + result = support_capture_subprocess (do_test_chroot, temp_dir); + support_capture_subprocess_check (&result, "freopen4", 0, + sc_allow_stdout); + fputs (result.out.buffer, stdout); + support_capture_subprocess_free (&result); + return 0; } commit c090b0cb1cde74aaeec01663dd55d6681dc92075 Author: H.J. Lu Date: Sat Jul 19 07:43:29 2025 -0700 tst-env-setuid: Delete LD_DEBUG_OUTPUT output Update tst-env-setuid.c to delete LD_DEBUG_OUTPUT output, instead of leaving it behind. This partially fixes BZ #33182. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella (cherry picked from commit 5d23dfb289174d73b8907b86d2bef7a3ca889840) diff --git a/elf/tst-env-setuid.c b/elf/tst-env-setuid.c index 7209acd616..ff3eda7f91 100644 --- a/elf/tst-env-setuid.c +++ b/elf/tst-env-setuid.c @@ -40,6 +40,8 @@ static char SETGID_CHILD[] = "setgid-child"; # define PROFILE_LIB "tst-sonamemove-runmod2.so" #endif +#define LD_DEBUG_OUTPUT "/tmp/some-file" + struct envvar_t { const char *env; @@ -61,7 +63,7 @@ static const struct envvar_t filtered_envvars[] = { "MALLOC_TRIM_THRESHOLD_", FILTERED_VALUE }, { "RES_OPTIONS", FILTERED_VALUE }, { "LD_DEBUG", "all" }, - { "LD_DEBUG_OUTPUT", "/tmp/some-file" }, + { "LD_DEBUG_OUTPUT", LD_DEBUG_OUTPUT }, { "LD_WARN", FILTERED_VALUE }, { "LD_VERBOSE", FILTERED_VALUE }, { "LD_BIND_NOW", "0" }, @@ -74,6 +76,14 @@ static const struct envvar_t unfiltered_envvars[] = { "LD_ASSUME_KERNEL", UNFILTERED_VALUE }, }; +static void +unlink_ld_debug_output (pid_t pid) +{ + char *output = xasprintf ("%s.%d", LD_DEBUG_OUTPUT, pid); + unlink (output); + free (output); +} + static int test_child (void) { @@ -138,13 +148,21 @@ do_test (int argc, char **argv) /* Setgid child process. */ if (argc == 2 && strcmp (argv[1], SETGID_CHILD) == 0) { + pid_t ppid = getppid (); + if (getgid () == getegid ()) - /* This can happen if the file system is mounted nosuid. */ - FAIL_UNSUPPORTED ("SGID failed: GID and EGID match (%jd)\n", - (intmax_t) getgid ()); + { + /* This can happen if the file system is mounted nosuid. */ + unlink_ld_debug_output (ppid); + + FAIL_UNSUPPORTED ("SGID failed: GID and EGID match (%jd)\n", + (intmax_t) getgid ()); + } int ret = test_child (); + unlink_ld_debug_output (ppid); + if (ret != 0) exit (1); return 0; commit e5754399b542640f3f69c5e2513c57a307656032 Author: H.J. Lu Date: Tue Aug 5 09:16:14 2025 -0700 Revert "tst-freopen4-main.c: Call support_capture_subprocess with chroot" Revert commit 6463d4a7b28e5ee3891c34a8a1f0a59c24dfa9de to fix FAIL: stdio-common/tst-freopen4-mem FAIL: stdio-common/tst-freopen64-4-mem This fixes BZ #33254. Reviewed-by: Sam James (cherry picked from commit adec0bf05bc23ec35573c7a5b96440089b69265e) diff --git a/stdio-common/tst-freopen4-main.c b/stdio-common/tst-freopen4-main.c index 436da4d203..3336f5327d 100644 --- a/stdio-common/tst-freopen4-main.c +++ b/stdio-common/tst-freopen4-main.c @@ -28,15 +28,25 @@ #include #include #include -#include -static void -do_test_chroot (void *data) +int +do_test (void) { - char *temp_dir = (char *) data; + mtrace (); + char *temp_dir; FILE *fp; int ret; + /* These chroot tests verify that either reopening a renamed or + deleted file works even in the absence of /proc, or that it fails + (without memory leaks); thus, for example, such reopening does + not crash in the absence of /proc. */ + + support_become_root (); + if (!support_can_chroot ()) + return EXIT_UNSUPPORTED; + + temp_dir = support_create_temp_directory ("tst-freopen4"); xchroot (temp_dir); /* Test freopen with NULL, renamed file. This verifies that @@ -86,32 +96,6 @@ do_test_chroot (void *data) puts ("freopen of deleted file failed (OK)"); free (temp_dir); -} - -int -do_test (void) -{ - mtrace (); - char *temp_dir; - - /* These chroot tests verify that either reopening a renamed or - deleted file works even in the absence of /proc, or that it fails - (without memory leaks); thus, for example, such reopening does - not crash in the absence of /proc. */ - - support_become_root (); - if (!support_can_chroot ()) - return EXIT_UNSUPPORTED; - - temp_dir = support_create_temp_directory ("tst-freopen4"); - - struct support_capture_subprocess result; - result = support_capture_subprocess (do_test_chroot, temp_dir); - support_capture_subprocess_check (&result, "freopen4", 0, - sc_allow_stdout); - fputs (result.out.buffer, stdout); - support_capture_subprocess_free (&result); - return 0; } commit c5476b7907d01207ede6bf57b26cef151b601f35 Author: Samuel Thibault Date: Fri Jul 18 23:14:40 2025 +0200 hurd: support: Fix running SGID tests Secure mode is enabled only if SGID actually provides a new privilege, so we have to drop it before gaining it again. Fixes commit 3a3fb2ed83f79100c116c824454095ecfb335ad7 ("Fix error reporting (false negatives) in SGID tests") (cherry picked from commit ad4589e2d834c80a042a8c354fb00cf33e06802c) diff --git a/support/support_capture_subprocess.c b/support/support_capture_subprocess.c index b4e4bf9502..c89e65b534 100644 --- a/support/support_capture_subprocess.c +++ b/support/support_capture_subprocess.c @@ -133,6 +133,27 @@ copy_and_spawn_sgid (const char *child_id, gid_t gid) if (chmod (execname, 02750) != 0) FAIL_UNSUPPORTED ("cannot make \"%s\" SGID: %m ", execname); + /* Now we can drop the privilege of that group. */ + const int count = 64; + gid_t groups[count]; + int ngroups = getgroups(count, groups); + + if (ngroups < 0) + FAIL_UNSUPPORTED ("Could not get group list again for user %jd\n", + (intmax_t) getuid ()); + + int n = 0; + for (int i = 0; i < ngroups; i++) + { + if (groups[i] != gid) + { + if (n != i) + groups[n] = groups[i]; + n++; + } + } + setgroups (n, groups); + /* We have the binary, now spawn the subprocess. Avoid using support_subprogram because we only want the program exit status, not the contents. */ commit 8a726b63047241c6dd4b55bf85eacd02244362a2 Author: Wilco Dijkstra Date: Thu Jul 10 15:49:14 2025 +0000 malloc: Remove redundant NULL check Remove a redundant NULL check from tcache_get_n. Reviewed-by: Cupertino Miranda (cherry picked from commit 089b4fb90fac8ed53039bc4c465c4d333c6b4048) diff --git a/malloc/malloc.c b/malloc/malloc.c index 5ca390cc22..cf5c02ff64 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3208,11 +3208,10 @@ tcache_get_n (size_t tc_idx, tcache_entry **ep, bool mangled) if (__glibc_unlikely (misaligned_mem (e))) malloc_printerr ("malloc(): unaligned tcache chunk detected"); - void *ne = e == NULL ? NULL : REVEAL_PTR (e->next); if (!mangled) - *ep = ne; + *ep = REVEAL_PTR (e->next); else - *ep = PROTECT_PTR (ep, ne); + *ep = PROTECT_PTR (ep, REVEAL_PTR (e->next)); ++(tcache->num_slots[tc_idx]); e->key = 0; @@ -3229,7 +3228,7 @@ tcache_put (mchunkptr chunk, size_t tc_idx) static __always_inline void * tcache_get (size_t tc_idx) { - return tcache_get_n (tc_idx, & tcache->entries[tc_idx], false); + return tcache_get_n (tc_idx, &tcache->entries[tc_idx], false); } static __always_inline tcache_entry ** commit c491dabd8a3de090d1ccb4589421a44e79c5b185 Author: Wilco Dijkstra Date: Thu Jul 17 14:31:06 2025 +0000 malloc: Fix MAX_TCACHE_SMALL_SIZE MAX_TCACHE_SMALL_SIZE should use chunk size since it is used after checked_request2size. Increase limit of tcache_max_bytes by 1 since all comparisons use '<'. As a result, the last tcache entry is now used as expected. Reviewed-by: DJ Delorie (cherry picked from commit ad4caba4146583fc543cd434221dec7113c03e09) diff --git a/malloc/malloc.c b/malloc/malloc.c index cf5c02ff64..b89b654f17 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -294,9 +294,9 @@ # define TCACHE_SMALL_BINS 64 # define TCACHE_LARGE_BINS 12 /* Up to 4M chunks */ # define TCACHE_MAX_BINS (TCACHE_SMALL_BINS + TCACHE_LARGE_BINS) -# define MAX_TCACHE_SMALL_SIZE tidx2usize (TCACHE_SMALL_BINS-1) +# define MAX_TCACHE_SMALL_SIZE tidx2csize (TCACHE_SMALL_BINS-1) -/* Only used to pre-fill the tunables. */ +# define tidx2csize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE) # define tidx2usize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ) /* When "x" is from chunksize(). */ @@ -1932,7 +1932,7 @@ static struct malloc_par mp_ = , .tcache_count = TCACHE_FILL_COUNT, .tcache_small_bins = TCACHE_SMALL_BINS, - .tcache_max_bytes = MAX_TCACHE_SMALL_SIZE, + .tcache_max_bytes = MAX_TCACHE_SMALL_SIZE + 1, .tcache_unsorted_limit = 0 /* No limit. */ #endif }; @@ -5586,15 +5586,13 @@ do_set_arena_max (size_t value) static __always_inline int do_set_tcache_max (size_t value) { + if (value > PTRDIFF_MAX) + return 0; + size_t nb = request2size (value); size_t tc_idx = csize2tidx (nb); - /* To check that value is not too big and request2size does not return an - overflown value. */ - if (value > nb) - return 0; - - if (nb > MAX_TCACHE_SMALL_SIZE) + if (tc_idx >= TCACHE_SMALL_BINS) tc_idx = large_csize2tidx (nb); LIBC_PROBE (memory_tunable_tcache_max_bytes, 2, value, mp_.tcache_max_bytes); @@ -5603,7 +5601,7 @@ do_set_tcache_max (size_t value) { if (tc_idx < TCACHE_SMALL_BINS) mp_.tcache_small_bins = tc_idx + 1; - mp_.tcache_max_bytes = nb; + mp_.tcache_max_bytes = nb + 1; return 1; } commit a96a82c4a5efd3139e75cd11fd2a5554164dd5a0 Author: Samuel Thibault Date: Wed Jul 30 01:55:22 2025 +0200 malloc: Make sure tcache_key is odd enough We want tcache_key not to be a commonly-occurring value in memory, so ensure a minimum amount of one and zero bits. And we need it non-zero, otherwise even if tcache_double_free_verify sets e->key to 0 before calling __libc_free, it gets called again by __libc_free, thus looping indefinitely. Fixes: c968fe50628db74b52124d863cd828225a1d305c ("malloc: Use tailcalls in __libc_free") (cherry picked from commit 2536c4f8584082a1ac4c5e0a2a6222e290d43983) diff --git a/malloc/malloc.c b/malloc/malloc.c index b89b654f17..e4e2f03600 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -230,6 +230,9 @@ /* For uintptr_t. */ #include +/* For stdc_count_ones. */ +#include + /* For va_arg, va_start, va_end. */ #include @@ -3152,6 +3155,19 @@ tcache_key_initialize (void) if (__getrandom_nocancel_nostatus_direct (&tcache_key, sizeof(tcache_key), GRND_NONBLOCK) != sizeof (tcache_key)) + tcache_key = 0; + + /* We need tcache_key to be non-zero (otherwise tcache_double_free_verify's + clearing of e->key would go unnoticed and it would loop getting called + through __libc_free), and we want tcache_key not to be a + commonly-occurring value in memory, so ensure a minimum amount of one and + zero bits. */ + int minimum_bits = __WORDSIZE / 4; + int maximum_bits = __WORDSIZE - minimum_bits; + + while (labs (tcache_key) <= 0x1000000 + || stdc_count_ones (tcache_key) < minimum_bits + || stdc_count_ones (tcache_key) > maximum_bits) { tcache_key = random_bits (); #if __WORDSIZE == 64 commit d7274d718e6f3655eabe311d4eb70fabb5ffa7ef Author: Samuel Thibault Date: Sun Aug 10 23:43:37 2025 +0200 malloc: Fix checking for small negative values of tcache_key tcache_key is unsigned so we should turn it explicitly to signed before taking its absolute value. (cherry picked from commit 8543577b04ded6d979ffcc5a818930e4d74d0645) diff --git a/malloc/malloc.c b/malloc/malloc.c index e4e2f03600..5f3e701fd1 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3165,7 +3165,7 @@ tcache_key_initialize (void) int minimum_bits = __WORDSIZE / 4; int maximum_bits = __WORDSIZE - minimum_bits; - while (labs (tcache_key) <= 0x1000000 + while (labs ((intptr_t) tcache_key) <= 0x1000000 || stdc_count_ones (tcache_key) < minimum_bits || stdc_count_ones (tcache_key) > maximum_bits) { commit 8dbaecbe92ac7ab73b7d0aae84626af59131e41b Author: Jens Remus Date: Fri Jul 25 15:40:03 2025 +0200 Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables [BZ #33234] Commit 10a66a8e421b ("Remove ") removed the TLS initial-exec (IE) model attribute from the __libc_tsd_CTYPE_* thread variable declarations and definitions. Commit a894f04d8776 ("Optimize __libc_tsd_* thread variable access") restored it on declarations. Restore the TLS initial-exec model attribute on __libc_tsd_CTYPE_* thread variable definitions. This resolves test tst-locale1 failure on s390 32-bit, when using a GNU linker without the fix from GNU binutils commit aefebe82dc89 ("IBM zSystems: Fix offset relative to static TLS"). Reviewed-by: Florian Weimer (cherry picked from commit e5363e6f460c2d58809bf10fc96d70fd1ef8b5b2) diff --git a/NEWS b/NEWS index 1d04bdfef8..69aa600c6d 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ The following bugs were resolved with this release: [31943] _dl_find_object can fail if ld.so contains gaps between load segments [32994] stdlib: resolve a double lock init issue after fork + [33234] Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables [33245] nptl: nptl: error in internal cancellation syscall handling Version 2.42 diff --git a/ctype/ctype-info.c b/ctype/ctype-info.c index b7d3422726..fb5acf9419 100644 --- a/ctype/ctype-info.c +++ b/ctype/ctype-info.c @@ -24,11 +24,11 @@ __ctype_init before user code runs, but this does not happen for threads in secondary namespaces. With the initializers, secondary namespaces at least get locale data from the C locale. */ -__thread const uint16_t * __libc_tsd_CTYPE_B +__thread const uint16_t * __libc_tsd_CTYPE_B attribute_tls_model_ie = (const uint16_t *) _nl_C_LC_CTYPE_class + 128; -__thread const int32_t * __libc_tsd_CTYPE_TOLOWER +__thread const int32_t * __libc_tsd_CTYPE_TOLOWER attribute_tls_model_ie = (const int32_t *) _nl_C_LC_CTYPE_tolower + 128; -__thread const int32_t * __libc_tsd_CTYPE_TOUPPER +__thread const int32_t * __libc_tsd_CTYPE_TOUPPER attribute_tls_model_ie = (const int32_t *) _nl_C_LC_CTYPE_toupper + 128; commit d0f72b96f2e91e1aa93f7e826c71f74078ada7d0 Author: H.J. Lu Date: Mon Jul 28 12:16:11 2025 -0700 i386: Add GLIBC_ABI_GNU_TLS version [BZ #33221] On i386, programs and shared libraries with __thread usage may fail silently at run-time against glibc without the TLS run-time fix for: https://sourceware.org/bugzilla/show_bug.cgi?id=32996 Add GLIBC_ABI_GNU_TLS version to indicate that glibc has the working GNU TLS run-time. Linker can add the GLIBC_ABI_GNU_TLS version to binaries which depend on the working TLS run-time so that such programs and shared libraries will fail to load and run at run-time against libc.so without the GLIBC_ABI_GNU_TLS version, instead of fail silently at random. This fixes BZ #33221. Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit ed1b7a5a489ab555a27fad9c101ebe2e1c1ba881) diff --git a/sysdeps/i386/Makefile b/sysdeps/i386/Makefile index ee6470d78e..c0c017b899 100644 --- a/sysdeps/i386/Makefile +++ b/sysdeps/i386/Makefile @@ -60,6 +60,15 @@ $(objpfx)tst-ld-sse-use.out: ../sysdeps/i386/tst-ld-sse-use.sh $(objpfx)ld.so @echo "Checking ld.so for SSE register use. This will take a few seconds..." $(BASH) $< $(objpfx) '$(NM)' '$(OBJDUMP)' '$(READELF)' > $@; \ $(evaluate-test) + +tests-special += $(objpfx)check-gnu-tls.out + +$(objpfx)check-gnu-tls.out: $(common-objpfx)libc.so + LC_ALL=C $(READELF) -V -W $< \ + | sed -ne '/.gnu.version_d/, /.gnu.version_r/ p' \ + | grep GLIBC_ABI_GNU_TLS > $@; \ + $(evaluate-test) +generated += check-gnu-tls.out else CFLAGS-.os += $(if $(filter rtld-%.os,$(@F)), $(rtld-CFLAGS)) endif diff --git a/sysdeps/i386/Versions b/sysdeps/i386/Versions index 36e23b466a..9c84c8ef04 100644 --- a/sysdeps/i386/Versions +++ b/sysdeps/i386/Versions @@ -28,6 +28,11 @@ libc { GLIBC_2.13 { __fentry__; } + GLIBC_ABI_GNU_TLS { + # This symbol is used only for empty version map and will be removed + # by scripts/versions.awk. + __placeholder_only_for_empty_version_map; + } } libm { GLIBC_2.1 { commit 3970785bebcc3f1de4460072f3a041d178f64846 Author: H.J. Lu Date: Mon Jul 28 12:18:22 2025 -0700 x86-64: Add GLIBC_ABI_GNU2_TLS version [BZ #33129] Programs and shared libraries compiled with -mtls-dialect=gnu2 may fail silently at run-time against glibc without the GNU2 TLS run-time fix for: https://sourceware.org/bugzilla/show_bug.cgi?id=31372 Add GLIBC_ABI_GNU2_TLS version to indicate that glibc has the working GNU2 TLS run-time. Linker can add the GLIBC_ABI_GNU2_TLS version to binaries which depend on the working GNU2 TLS run-time: https://sourceware.org/bugzilla/show_bug.cgi?id=33130 so that such programs and shared libraries will fail to load and run at run-time against libc.so without the GLIBC_ABI_GNU2_TLS version, instead of fail silently at random. This fixes BZ #33129. Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit 9df8fa397d515dc86ff5565f6c45625e672d539e) diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile index c3e1065c81..3ab8c1ed0f 100644 --- a/sysdeps/x86_64/Makefile +++ b/sysdeps/x86_64/Makefile @@ -212,6 +212,15 @@ LDFLAGS-tst-plt-rewrite2 = -Wl,-z,now LDFLAGS-tst-plt-rewritemod2.so = -Wl,-z,now,-z,undefs tst-plt-rewrite2-ENV = GLIBC_TUNABLES=glibc.cpu.plt_rewrite=2 $(objpfx)tst-plt-rewrite2: $(objpfx)tst-plt-rewritemod2.so + +tests-special += $(objpfx)check-gnu2-tls.out + +$(objpfx)check-gnu2-tls.out: $(common-objpfx)libc.so + LC_ALL=C $(READELF) -V -W $< \ + | sed -ne '/.gnu.version_d/, /.gnu.version_r/ p' \ + | grep GLIBC_ABI_GNU2_TLS > $@; \ + $(evaluate-test) +generated += check-gnu2-tls.out endif test-internal-extras += tst-gnu2-tls2mod1 diff --git a/sysdeps/x86_64/Versions b/sysdeps/x86_64/Versions index e94758b236..a63c11bcb2 100644 --- a/sysdeps/x86_64/Versions +++ b/sysdeps/x86_64/Versions @@ -5,6 +5,11 @@ libc { GLIBC_2.13 { __fentry__; } + GLIBC_ABI_GNU2_TLS { + # This symbol is used only for empty version map and will be removed + # by scripts/versions.awk. + __placeholder_only_for_empty_version_map; + } } libm { GLIBC_2.1 { commit 7a8f3c6ee4b565a02da4ba0dad9aaeaeed4639ce Author: H.J. Lu Date: Thu Aug 14 07:03:20 2025 -0700 x86-64: Add GLIBC_ABI_DT_X86_64_PLT [BZ #33212] When the linker -z mark-plt option is used to add DT_X86_64_PLT, DT_X86_64_PLTSZ and DT_X86_64_PLTENT, the r_addend field of the R_X86_64_JUMP_SLOT relocation stores the offset of the indirect branch instruction. However, glibc versions without the commit: commit f8587a61892cbafd98ce599131bf4f103466f084 Author: H.J. Lu Date: Fri May 20 19:21:48 2022 -0700 x86-64: Ignore r_addend for R_X86_64_GLOB_DAT/R_X86_64_JUMP_SLOT According to x86-64 psABI, r_addend should be ignored for R_X86_64_GLOB_DAT and R_X86_64_JUMP_SLOT. Since linkers always set their r_addends to 0, we can ignore their r_addends. Reviewed-by: Fangrui Song won't ignore the r_addend value in the R_X86_64_JUMP_SLOT relocation. Such programs and shared libraries will fail at run-time randomly. Add GLIBC_ABI_DT_X86_64_PLT version to indicate that glibc is compatible with DT_X86_64_PLT. The linker can add the glibc GLIBC_ABI_DT_X86_64_PLT version dependency whenever -z mark-plt is passed to the linker. The resulting programs and shared libraries will fail to load at run-time against libc.so without the GLIBC_ABI_DT_X86_64_PLT version, instead of fail randomly. This fixes BZ #33212. Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit 399384e0c8193e31aea014220ccfa24300ae5938) diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile index 3ab8c1ed0f..01100597a8 100644 --- a/sysdeps/x86_64/Makefile +++ b/sysdeps/x86_64/Makefile @@ -213,6 +213,15 @@ LDFLAGS-tst-plt-rewritemod2.so = -Wl,-z,now,-z,undefs tst-plt-rewrite2-ENV = GLIBC_TUNABLES=glibc.cpu.plt_rewrite=2 $(objpfx)tst-plt-rewrite2: $(objpfx)tst-plt-rewritemod2.so +tests-special += $(objpfx)check-dt-x86-64-plt.out + +$(objpfx)check-dt-x86-64-plt.out: $(common-objpfx)libc.so + LC_ALL=C $(READELF) -V -W $< \ + | sed -ne '/.gnu.version_d/, /.gnu.version_r/ p' \ + | grep GLIBC_ABI_DT_X86_64_PLT > $@; \ + $(evaluate-test) +generated += check-dt-x86-64-plt.out + tests-special += $(objpfx)check-gnu2-tls.out $(objpfx)check-gnu2-tls.out: $(common-objpfx)libc.so diff --git a/sysdeps/x86_64/Versions b/sysdeps/x86_64/Versions index a63c11bcb2..0a759029e5 100644 --- a/sysdeps/x86_64/Versions +++ b/sysdeps/x86_64/Versions @@ -10,6 +10,11 @@ libc { # by scripts/versions.awk. __placeholder_only_for_empty_version_map; } + GLIBC_ABI_DT_X86_64_PLT { + # This symbol is used only for empty version map and will be removed + # by scripts/versions.awk. + __placeholder_only_for_empty_version_map; + } } libm { GLIBC_2.1 { commit e87844ec42b77363a499ea4da6c4a6ab85eba310 Author: H.J. Lu Date: Mon Aug 18 09:06:48 2025 -0700 i386: Also add GLIBC_ABI_GNU2_TLS version [BZ #33129] Since the GNU2 TLS run-time bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31372 affects both i386 and x86-64, also add GLIBC_ABI_GNU2_TLS version to i386 to indicate the working GNU2 TLS run-time. For x86-64, the additional GNU2 TLS run-time bug fix is needed for https://sourceware.org/bugzilla/show_bug.cgi?id=31501 Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit bd4628f3f18ac312408782eea450429c6f044860) diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 4fbd48e1c8..9e1c8cce85 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -135,6 +135,15 @@ LDFLAGS-tst-tls23 += -rdynamic tst-tls23-mod.so-no-z-defs = yes $(objpfx)tst-tls23-mod.so: $(libsupport) + +tests-special += $(objpfx)check-gnu2-tls.out + +$(objpfx)check-gnu2-tls.out: $(common-objpfx)libc.so + LC_ALL=C $(READELF) -V -W $< \ + | sed -ne '/.gnu.version_d/, /.gnu.version_r/ p' \ + | grep GLIBC_ABI_GNU2_TLS > $@; \ + $(evaluate-test) +generated += check-gnu2-tls.out endif ifeq ($(subdir),gmon) diff --git a/sysdeps/x86/Versions b/sysdeps/x86/Versions index 4b10c4b5d7..e8dcfccbe4 100644 --- a/sysdeps/x86/Versions +++ b/sysdeps/x86/Versions @@ -7,4 +7,9 @@ libc { GLIBC_2.33 { __x86_get_cpuid_feature_leaf; } + GLIBC_ABI_GNU2_TLS { + # This symbol is used only for empty version map and will be removed + # by scripts/versions.awk. + __placeholder_only_for_empty_version_map; + } } diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile index 01100597a8..fe9f1cdddb 100644 --- a/sysdeps/x86_64/Makefile +++ b/sysdeps/x86_64/Makefile @@ -221,15 +221,6 @@ $(objpfx)check-dt-x86-64-plt.out: $(common-objpfx)libc.so | grep GLIBC_ABI_DT_X86_64_PLT > $@; \ $(evaluate-test) generated += check-dt-x86-64-plt.out - -tests-special += $(objpfx)check-gnu2-tls.out - -$(objpfx)check-gnu2-tls.out: $(common-objpfx)libc.so - LC_ALL=C $(READELF) -V -W $< \ - | sed -ne '/.gnu.version_d/, /.gnu.version_r/ p' \ - | grep GLIBC_ABI_GNU2_TLS > $@; \ - $(evaluate-test) -generated += check-gnu2-tls.out endif test-internal-extras += tst-gnu2-tls2mod1 diff --git a/sysdeps/x86_64/Versions b/sysdeps/x86_64/Versions index 0a759029e5..6a989ad3b3 100644 --- a/sysdeps/x86_64/Versions +++ b/sysdeps/x86_64/Versions @@ -5,11 +5,6 @@ libc { GLIBC_2.13 { __fentry__; } - GLIBC_ABI_GNU2_TLS { - # This symbol is used only for empty version map and will be removed - # by scripts/versions.awk. - __placeholder_only_for_empty_version_map; - } GLIBC_ABI_DT_X86_64_PLT { # This symbol is used only for empty version map and will be removed # by scripts/versions.awk. commit e34453cd6a8c592c325756ff3c7ac0afd3975cb4 Author: Pierre Blanchard Date: Wed Aug 20 17:41:50 2025 +0000 AArch64: Fix SVE powf routine [BZ #33299] Fix a bug in predicate logic introduced in last change. A slight performance improvement from relying on all true predicates during conversion from single to double. This fixes BZ #33299. Reviewed-by: Wilco Dijkstra (cherry picked from commit aac077645a645bba0d67f3250e82017c539d0f4b) diff --git a/sysdeps/aarch64/fpu/powf_sve.c b/sysdeps/aarch64/fpu/powf_sve.c index 7046990aa1..65e9bd29d9 100644 --- a/sysdeps/aarch64/fpu/powf_sve.c +++ b/sysdeps/aarch64/fpu/powf_sve.c @@ -223,15 +223,15 @@ sv_powf_core (const svbool_t pg, svuint32_t i, svuint32_t iz, svint32_t k, const svbool_t ptrue = svptrue_b64 (); /* Unpack and promote input vectors (pg, y, z, i, k and sign_bias) into two - * in order to perform core computation in double precision. */ + in order to perform core computation in double precision. */ const svbool_t pg_lo = svunpklo (pg); const svbool_t pg_hi = svunpkhi (pg); - svfloat64_t y_lo - = svcvt_f64_x (pg, svreinterpret_f32 (svunpklo (svreinterpret_u32 (y)))); - svfloat64_t y_hi - = svcvt_f64_x (pg, svreinterpret_f32 (svunpkhi (svreinterpret_u32 (y)))); - svfloat64_t z_lo = svcvt_f64_x (pg, svreinterpret_f32 (svunpklo (iz))); - svfloat64_t z_hi = svcvt_f64_x (pg, svreinterpret_f32 (svunpkhi (iz))); + svfloat64_t y_lo = svcvt_f64_x ( + ptrue, svreinterpret_f32 (svunpklo (svreinterpret_u32 (y)))); + svfloat64_t y_hi = svcvt_f64_x ( + ptrue, svreinterpret_f32 (svunpkhi (svreinterpret_u32 (y)))); + svfloat64_t z_lo = svcvt_f64_x (ptrue, svreinterpret_f32 (svunpklo (iz))); + svfloat64_t z_hi = svcvt_f64_x (ptrue, svreinterpret_f32 (svunpkhi (iz))); svuint64_t i_lo = svunpklo (i); svuint64_t i_hi = svunpkhi (i); svint64_t k_lo = svunpklo (k); @@ -312,7 +312,7 @@ svfloat32_t SV_NAME_F2 (pow) (svfloat32_t x, svfloat32_t y, const svbool_t pg) (23 - V_POWF_EXP2_TABLE_BITS)); /* Compute core in extended precision and return intermediate ylogx results - * to handle cases of underflow and underflow in exp. */ + to handle cases of underflow and overflow in exp. */ svfloat32_t ylogx; svfloat32_t ret = sv_powf_core (yint_or_xpos, i, iz, k, y, sign_bias, &ylogx, d); commit 1166170d95863e5a6f8121a5ca9d97713f524f49 Author: Florian Weimer Date: Fri Sep 5 19:02:57 2025 +0200 libio: Define AT_RENAME_* with the same tokens as Linux Linux uses different expressions for the RENAME_* and AT_RENAME_* constants. Mirror that in , so that the macro redefinitions do not result in preprocessor warnings. Reviewed-by: Collin Funk (cherry picked from commit b173557da978a04ac3bdfc0bd3b0e7ac583b44d5) diff --git a/libio/stdio.h b/libio/stdio.h index d042b36618..e0e70945fa 100644 --- a/libio/stdio.h +++ b/libio/stdio.h @@ -168,11 +168,11 @@ extern int renameat (int __oldfd, const char *__old, int __newfd, #ifdef __USE_GNU /* Flags for renameat2. */ # define RENAME_NOREPLACE (1 << 0) -# define AT_RENAME_NOREPLACE RENAME_NOREPLACE +# define AT_RENAME_NOREPLACE 0x0001 # define RENAME_EXCHANGE (1 << 1) -# define AT_RENAME_EXCHANGE RENAME_EXCHANGE +# define AT_RENAME_EXCHANGE 0x0002 # define RENAME_WHITEOUT (1 << 2) -# define AT_RENAME_WHITEOUT RENAME_WHITEOUT +# define AT_RENAME_WHITEOUT 0x0004 /* Rename file OLD relative to OLDFD to NEW relative to NEWFD, with additional flags. */ diff --git a/stdio-common/tst-renameat2.c b/stdio-common/tst-renameat2.c index 12aa0f8b0f..6213e1376d 100644 --- a/stdio-common/tst-renameat2.c +++ b/stdio-common/tst-renameat2.c @@ -28,6 +28,12 @@ #include #include +/* These constants are defined with different token sequences, + matching the Linux definitions, to avoid preprocessor warnings. */ +_Static_assert (RENAME_NOREPLACE == AT_RENAME_NOREPLACE, "RENAME_NOREPLACE"); +_Static_assert (RENAME_EXCHANGE == AT_RENAME_EXCHANGE, "RENAME_EXCHANGE"); +_Static_assert (RENAME_WHITEOUT == AT_RENAME_WHITEOUT, "RENAME_WHITEOUT"); + /* Directory with the temporary files. */ static char *directory; static int directory_fd; commit 46b4e37c9e0619d0cf065ba207c29996b326a06f Author: Florian Weimer Date: Fri Sep 12 21:33:34 2025 +0200 nss: Group merge does not react to ERANGE during merge (bug 33361) The break statement in CHECK_MERGE is expected to exit the surrounding while loop, not the do-while loop with in the macro. Remove the do-while loop from the macro. It is not needed to turn the macro expansion into a single statement due to the way CHECK_MERGE is used (and the statement expression would cover this anyway). Reviewed-by: Collin Funk (cherry picked from commit 0fceed254559836b57ee05188deac649bc505d05) diff --git a/NEWS b/NEWS index 69aa600c6d..06c27a8e17 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,7 @@ The following bugs were resolved with this release: [32994] stdlib: resolve a double lock init issue after fork [33234] Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables [33245] nptl: nptl: error in internal cancellation syscall handling + [33361] nss: Group merge does not react to ERANGE during merge Version 2.42 diff --git a/nss/getXXbyYY_r.c b/nss/getXXbyYY_r.c index eae6c3480e..2b0735fb6a 100644 --- a/nss/getXXbyYY_r.c +++ b/nss/getXXbyYY_r.c @@ -157,19 +157,15 @@ __merge_einval (LOOKUP_TYPE *a, #define CHECK_MERGE(err, status) \ ({ \ - do \ + if (err) \ { \ - if (err) \ - { \ - __set_errno (err); \ - if (err == ERANGE) \ - status = NSS_STATUS_TRYAGAIN; \ - else \ - status = NSS_STATUS_UNAVAIL; \ - break; \ - } \ + __set_errno (err); \ + if (err == ERANGE) \ + status = NSS_STATUS_TRYAGAIN; \ + else \ + status = NSS_STATUS_UNAVAIL; \ + break; \ } \ - while (0); \ }) /* Type of the lookup function we need here. */