Submitted by: Xi Ruoyao Date: 2026-09-18 Initial Package Version: 2.44 Origin: 1st-47th from upstream release/2.44/master branch (see the From: lines for revision) 48th from upstream master branch (see the cherry picked from line for revision) 49th from upstream mailing list (see the Link: line for URL) Upstream Status: 1st-48th applied, 49th approved Description: This fixes multiple issues with the stable 2.44 release, namely with tanh crashing, issues with building and installing glibc with multiple make jobs, and doing certain steps in the right order. Fixes non-lethal but potentially dangerous errors with regular LFS, but is required for MLFS, and brings in the fix for tanh shown in LFS. Fixes 6 security vulnerabilities: CVE-2026-18374, 19499, 19542, 77117, 80849, 8674. Other less-important changes are fetched from the release/2.44/master branch as well. From 5e5ddf57987ae4b37da5ca2fa039c8803b0be735 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20K=2E=20H=C3=BCttel?= Date: Sat, 25 Jul 2026 09:20:26 +0900 Subject: [PATCH 01/49] advisories: replace with ADVISORIES text file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Andreas K. Hüttel --- ADVISORIES | 2 + advisories/GLIBC-SA-2023-0001 | 14 ------ advisories/GLIBC-SA-2023-0002 | 15 ------ advisories/GLIBC-SA-2023-0003 | 15 ------ advisories/GLIBC-SA-2023-0004 | 16 ------ advisories/GLIBC-SA-2023-0005 | 18 ------- advisories/GLIBC-SA-2024-0001 | 15 ------ advisories/GLIBC-SA-2024-0002 | 15 ------ advisories/GLIBC-SA-2024-0003 | 13 ----- advisories/GLIBC-SA-2024-0004 | 28 ----------- advisories/GLIBC-SA-2024-0005 | 22 --------- advisories/GLIBC-SA-2024-0006 | 32 ------------ advisories/GLIBC-SA-2024-0007 | 28 ----------- advisories/GLIBC-SA-2024-0008 | 26 ---------- advisories/GLIBC-SA-2025-0001 | 40 --------------- advisories/GLIBC-SA-2025-0002 | 23 --------- advisories/GLIBC-SA-2025-0003 | 30 ------------ advisories/GLIBC-SA-2025-0004 | 29 ----------- advisories/GLIBC-SA-2025-0005 | 14 ------ advisories/GLIBC-SA-2026-0001 | 41 ---------------- advisories/GLIBC-SA-2026-0002 | 36 -------------- advisories/GLIBC-SA-2026-0003 | 36 -------------- advisories/GLIBC-SA-2026-0004 | 30 ------------ advisories/GLIBC-SA-2026-0005 | 37 -------------- advisories/GLIBC-SA-2026-0006 | 27 ---------- advisories/GLIBC-SA-2026-0007 | 15 ------ advisories/GLIBC-SA-2026-0008 | 22 --------- advisories/GLIBC-SA-2026-0009 | 23 --------- advisories/GLIBC-SA-2026-0010 | 24 --------- advisories/GLIBC-SA-2026-0011 | 24 --------- advisories/GLIBC-SA-2026-0012 | 18 ------- advisories/GLIBC-SA-2026-0013 | 20 -------- advisories/GLIBC-SA-2026-0014 | 19 -------- advisories/README | 92 ----------------------------------- 34 files changed, 2 insertions(+), 857 deletions(-) create mode 100644 ADVISORIES delete mode 100644 advisories/GLIBC-SA-2023-0001 delete mode 100644 advisories/GLIBC-SA-2023-0002 delete mode 100644 advisories/GLIBC-SA-2023-0003 delete mode 100644 advisories/GLIBC-SA-2023-0004 delete mode 100644 advisories/GLIBC-SA-2023-0005 delete mode 100644 advisories/GLIBC-SA-2024-0001 delete mode 100644 advisories/GLIBC-SA-2024-0002 delete mode 100644 advisories/GLIBC-SA-2024-0003 delete mode 100644 advisories/GLIBC-SA-2024-0004 delete mode 100644 advisories/GLIBC-SA-2024-0005 delete mode 100644 advisories/GLIBC-SA-2024-0006 delete mode 100644 advisories/GLIBC-SA-2024-0007 delete mode 100644 advisories/GLIBC-SA-2024-0008 delete mode 100644 advisories/GLIBC-SA-2025-0001 delete mode 100644 advisories/GLIBC-SA-2025-0002 delete mode 100644 advisories/GLIBC-SA-2025-0003 delete mode 100644 advisories/GLIBC-SA-2025-0004 delete mode 100644 advisories/GLIBC-SA-2025-0005 delete mode 100644 advisories/GLIBC-SA-2026-0001 delete mode 100644 advisories/GLIBC-SA-2026-0002 delete mode 100644 advisories/GLIBC-SA-2026-0003 delete mode 100644 advisories/GLIBC-SA-2026-0004 delete mode 100644 advisories/GLIBC-SA-2026-0005 delete mode 100644 advisories/GLIBC-SA-2026-0006 delete mode 100644 advisories/GLIBC-SA-2026-0007 delete mode 100644 advisories/GLIBC-SA-2026-0008 delete mode 100644 advisories/GLIBC-SA-2026-0009 delete mode 100644 advisories/GLIBC-SA-2026-0010 delete mode 100644 advisories/GLIBC-SA-2026-0011 delete mode 100644 advisories/GLIBC-SA-2026-0012 delete mode 100644 advisories/GLIBC-SA-2026-0013 delete mode 100644 advisories/GLIBC-SA-2026-0014 delete mode 100644 advisories/README diff --git a/ADVISORIES b/ADVISORIES new file mode 100644 index 0000000000..d4e33f2df3 --- /dev/null +++ b/ADVISORIES @@ -0,0 +1,2 @@ +For the GNU C Library Security Advisories, see the git master branch: +https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 deleted file mode 100644 index 3d19c91b6a..0000000000 --- a/advisories/GLIBC-SA-2023-0001 +++ /dev/null @@ -1,14 +0,0 @@ -printf: incorrect output for integers with thousands separator and width field - -When the printf family of functions is called with a format specifier -that uses an (enable grouping) and a minimum width -specifier, the resulting output could be larger than reasonably expected -by a caller that computed a tight bound on the buffer size. The -resulting larger than expected output could result in a buffer overflow -in the printf family of functions. - -CVE-Id: CVE-2023-25139 -Public-Date: 2023-02-02 -Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) -Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) -Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 deleted file mode 100644 index 5122669a64..0000000000 --- a/advisories/GLIBC-SA-2023-0002 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Stack read overflow in no-aaaa mode - -If the system is configured in no-aaaa mode via /etc/resolv.conf, -getaddrinfo is called for the AF_UNSPEC address family, and a DNS -response is received over TCP that is larger than 2048 bytes, -getaddrinfo may potentially disclose stack contents via the returned -address data, or crash. - -CVE-Id: CVE-2023-4527 -Public-Date: 2023-09-12 -Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) -Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) -Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) -Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) -Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 deleted file mode 100644 index d3aef80348..0000000000 --- a/advisories/GLIBC-SA-2023-0003 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Potential use-after-free - -When an NSS plugin only implements the _gethostbyname2_r and -_getcanonname_r callbacks, getaddrinfo could use memory that was freed -during buffer resizing, potentially causing a crash or read or write to -arbitrary memory. - -CVE-Id: CVE-2023-4806 -Public-Date: 2023-09-12 -Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) -Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 deleted file mode 100644 index 5286a7aa54..0000000000 --- a/advisories/GLIBC-SA-2023-0004 +++ /dev/null @@ -1,16 +0,0 @@ -tunables: local privilege escalation through buffer overflow - -If a tunable of the form NAME=NAME=VAL is passed in the environment of a -setuid program and NAME is valid, it may result in a buffer overflow, -which could be exploited to achieve escalated privileges. This flaw was -introduced in glibc 2.34. - -CVE-Id: CVE-2023-4911 -Public-Date: 2023-10-03 -Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) -Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) -Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) -Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) -Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) -Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) -Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 deleted file mode 100644 index cc4eb90b82..0000000000 --- a/advisories/GLIBC-SA-2023-0005 +++ /dev/null @@ -1,18 +0,0 @@ -getaddrinfo: DoS due to memory leak - -The fix for CVE-2023-4806 introduced a memory leak when an application -calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED -flags set. - -CVE-Id: CVE-2023-5156 -Public-Date: 2023-09-25 -Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) -Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) -Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) -Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) -Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) -Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001 deleted file mode 100644 index 28931c75ae..0000000000 --- a/advisories/GLIBC-SA-2024-0001 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER -containing a long program name failed to update the required buffer -size, leading to the allocation and overflow of a too-small buffer on -the heap. - -CVE-Id: CVE-2023-6246 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39) -Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42) -Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126) diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002 deleted file mode 100644 index 940bfcf2fc..0000000000 --- a/advisories/GLIBC-SA-2024-0002 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal used the return value of snprintf/vsnprintf to -calculate buffer sizes for memory allocation. If these functions (for -any reason) failed and returned -1, the resulting buffer would be too -small to hold output. - -CVE-Id: CVE-2023-6779 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39) -Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43) -Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127) diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003 deleted file mode 100644 index b43a5150ab..0000000000 --- a/advisories/GLIBC-SA-2024-0003 +++ /dev/null @@ -1,13 +0,0 @@ -syslog: Integer overflow in __vsyslog_internal - -__vsyslog_internal calculated a buffer size by adding two integers, but -did not first check if the addition would overflow. - -CVE-Id: CVE-2023-6780 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39) -Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44) -Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128) diff --git a/advisories/GLIBC-SA-2024-0004 b/advisories/GLIBC-SA-2024-0004 deleted file mode 100644 index 08df2b3118..0000000000 --- a/advisories/GLIBC-SA-2024-0004 +++ /dev/null @@ -1,28 +0,0 @@ -ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence - -The iconv() function in the GNU C Library versions 2.39 and older may -overflow the output buffer passed to it by up to 4 bytes when converting -strings to the ISO-2022-CN-EXT character set, which may be used to -crash an application or overwrite a neighbouring variable. - -ISO-2022-CN-EXT uses escape sequences to indicate character set changes -(as specified by RFC 1922). While the SOdesignation has the expected -bounds checks, neither SS2designation nor SS3designation have its; -allowing a write overflow of 1, 2, or 3 bytes with fixed values: -'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. - -CVE-Id: CVE-2024-2961 -Public-Date: 2024-04-17 -Vulnerable-Commit: 755104edc75c53f4a0e7440334e944ad3c6b32fc (2.1.93-169) -Fix-Commit: f9dc609e06b1136bb0408be9605ce7973a767ada (2.40) -Fix-Commit: 31da30f23cddd36db29d5b6a1c7619361b271fb4 (2.39-31) -Fix-Commit: e1135387deded5d73924f6ca20c72a35dc8e1bda (2.38-66) -Fix-Commit: 89ce64b269a897a7780e4c73a7412016381c6ecf (2.37-89) -Fix-Commit: 4ed98540a7fd19f458287e783ae59c41e64df7b5 (2.36-164) -Fix-Commit: 36280d1ce5e245aabefb877fe4d3c6cff95dabfa (2.35-315) -Fix-Commit: a8b0561db4b9847ebfbfec20075697d5492a363c (2.34-459) -Fix-Commit: ed4f16ff6bed3037266f1fa682ebd32a18fce29c (2.33-263) -Fix-Commit: 682ad4c8623e611a971839990ceef00346289cc9 (2.32-140) -Fix-Commit: 3703c32a8d304c1ee12126134ce69be965f38000 (2.31-154) - -Reported-By: Charles Fol diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005 deleted file mode 100644 index a59596610a..0000000000 --- a/advisories/GLIBC-SA-2024-0005 +++ /dev/null @@ -1,22 +0,0 @@ -nscd: Stack-based buffer overflow in netgroup cache - -If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted -by client requests then a subsequent client request for netgroup data -may result in a stack-based buffer overflow. This flaw was introduced -in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33599 -Public-Date: 2024-04-23 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155) -Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141) -Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264) -Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460) -Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316) -Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165) -Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91) -Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72) -Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35) -Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40) diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006 deleted file mode 100644 index d44148d3d9..0000000000 --- a/advisories/GLIBC-SA-2024-0006 +++ /dev/null @@ -1,32 +0,0 @@ -nscd: Null pointer crash after notfound response - -If the Name Service Cache Daemon's (nscd) cache fails to add a not-found -netgroup response to the cache, the client request can result in a null -pointer dereference. This flaw was introduced in glibc 2.15 when the -cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33600 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40) -Fix-Commit: 7835b00dbce53c3c87bbbb1754a95fb5e58187aa (2.40) -Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37) -Fix-Commit: 5a508e0b508c8ad53bd0d2fb48fd71b242626341 (2.39-36) -Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74) -Fix-Commit: 541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a (2.38-73) -Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93) -Fix-Commit: 5eea50c4402e39588de98aa1d4469a79774703d4 (2.37-92) -Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167) -Fix-Commit: c34f470a615b136170abd16142da5dd0c024f7d1 (2.36-166) -Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318) -Fix-Commit: 4370bef52b0f3f3652c6aa13d7a9bb3ac079746d (2.35-317) -Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462) -Fix-Commit: 966d6ac9e40222b84bb21674cc4f83c8d72a5a26 (2.34-461) -Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266) -Fix-Commit: f20a8d696b13c6261b52a6434899121f8b19d5a7 (2.33-265) -Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143) -Fix-Commit: 394eae338199078b7961b051c191539870742d7b (2.32-142) -Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157) -Fix-Commit: 304ce5fe466c4762b21b36c26926a4657b59b53e (2.31-156) diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007 deleted file mode 100644 index b6928fa27a..0000000000 --- a/advisories/GLIBC-SA-2024-0007 +++ /dev/null @@ -1,28 +0,0 @@ -nscd: netgroup cache may terminate daemon on memory allocation failure - -The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or -xrealloc and these functions may terminate the process due to a memory -allocation failure resulting in a denial of service to the clients. The -flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -Subsequent refactoring of the netgroup cache only added more uses of -xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of -nscd only occur during startup of the daemon and so are not affected by -client requests that could trigger an out of memory followed by -termination. - -CVE-Id: CVE-2024-33601 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008 deleted file mode 100644 index d93e2a6f0b..0000000000 --- a/advisories/GLIBC-SA-2024-0008 +++ /dev/null @@ -1,26 +0,0 @@ -nscd: netgroup cache assumes NSS callback uses in-buffer strings - -The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory -when the NSS callback does not store all strings in the provided buffer. -The flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -There is no guarantee from the NSS callback API that the returned -strings are all within the buffer. However, the netgroup cache code -assumes that the NSS callback uses in-buffer strings and if it doesn't -the buffer resizing logic could lead to potential memory corruption. - -CVE-Id: CVE-2024-33602 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2025-0001 b/advisories/GLIBC-SA-2025-0001 deleted file mode 100644 index b053d32e91..0000000000 --- a/advisories/GLIBC-SA-2025-0001 +++ /dev/null @@ -1,40 +0,0 @@ -assert: Buffer overflow when printing assertion failure message - -When the assert() function fails, it does not allocate enough space for the -assertion failure message string and size information, which may lead to a -buffer overflow if the message string size aligns to page size. - -This bug can be triggered when an assertion in a program fails. The assertion -failure message is allocated to allow developers to see this failure in core -dumps and it typically includes, in addition to the invariant assertion -string and function name, the name of the program. If the name of the failing -program is user controlled, for example on a local system, this could allow an -attacker to control the assertion failure to trigger this buffer overflow. - -The only viable vector for exploitation of this bug is local, if a setuid -program exists that has an existing bug that results in an assertion failure. -No such program has been discovered at the time of publishing this advisory, -but the presence of custom setuid programs, although strongly discouraged as a -security practice, cannot be discounted. - -CVE-Id: CVE-2025-0395 -Public-Date: 2025-01-22 -Vulnerable-Commit: f8a3b5bf8fa1d0c43d2458e03cc109a04fdef194 (2.13-175) -Fix-Commit: 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578 (2.41) -Fix-Commit: cdb9ba84191ce72e86346fb8b1d906e7cd930ea2 (2.42) -Fix-Commit: 69fda28279b497bd405fdd442a6d8e4d3d5f681b (2.41-7) -Fix-Commit: 7d4b6bcae91f29d7b4daf15bab06b66cf1d2217c (2.40-66) -Fix-Commit: d6c156c326999f144cb5b73d29982108d549ad8a (2.40-71) -Fix-Commit: 808a84a8b81468b517a4d721fdc62069cb8c211f (2.39-146) -Fix-Commit: f6d48470aef9264d2d56f4c4533eb76db7f9c2e4 (2.39-150) -Fix-Commit: c32fd59314c343db88c3ea4a203870481d33c3d2 (2.38-122) -Fix-Commit: f984e2d7e8299726891a1a497a3c36cd5542a0bf (2.38-124) -Fix-Commit: a3d7865b098a3a67c44f7812208d9ce4718873ba (2.37-143) -Fix-Commit: b989519fe1683c204ac24ec92830e3fe3bfaccad (2.37-146) -Fix-Commit: 7971add7ee4171fdd8dfd17e7c04c4ed77a18845 (2.36-216) -Fix-Commit: 0487893d5c5bc6710d83d7c3152d888a0339559e (2.36-219) -Fix-Commit: 8b5d4be762419c4f6176261c6fea40ac559b88dc (2.35-370) -Fix-Commit: 8b3d09dc0d350191985f9d291cc30ce96f034b49 (2.35-373) -Fix-Commit: df4e1f4a5096b385c9bcc94424cf2eaa227b3761 (2.34-500) -Fix-Commit: 31eb872cb21449832ab47ad5db83281d240e1d03 (2.34-503) -Reported-By: Qualys Security Advisory diff --git a/advisories/GLIBC-SA-2025-0002 b/advisories/GLIBC-SA-2025-0002 deleted file mode 100644 index 161da13dd4..0000000000 --- a/advisories/GLIBC-SA-2025-0002 +++ /dev/null @@ -1,23 +0,0 @@ -elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH - -A statically linked setuid binary that calls dlopen (including internal -dlopen calls after setlocale or calls to NSS functions such as getaddrinfo) -may incorrectly search LD_LIBRARY_PATH to determine which library to load, -leading to the execution of library code that is attacker controlled. - -The only viable vector for exploitation of this bug is local, if a static -setuid program exists, and that program calls dlopen, then it may search -LD_LIBRARY_PATH to locate the SONAME to load. No such program has been -discovered at the time of publishing this advisory, but the presence of -custom setuid programs, although strongly discouraged as a security -practice, cannot be discounted. - -CVE-Id: CVE-2025-4802 -Public-Date: 2025-05-16 -Vulnerable-Commit: 10e93d968716ab82931d593bada121c17c0a4b93 (2.27) -Fix-Commit: 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 (2.39) -Fix-Commit: 3be3728df2f1912c80abd3288bc6e3a25ad679e4 (2.38-132) -Fix-Commit: 7403ede2d7752e59e0c47d5d33d73c2bf850e7be (2.37-154) -Fix-Commit: 2ef7850279b2931caf6d6d6743ebaa91839e1cf7 (2.36-227) -Fix-Commit: 621c65ccf12ddd415ceeb2234423bd1acd0fabb3 (2.35-387) -Fix-Commit: 35018c0fd20eac9ceaf60060fed2745b3177359d (2.34-517) diff --git a/advisories/GLIBC-SA-2025-0003 b/advisories/GLIBC-SA-2025-0003 deleted file mode 100644 index 2adeb3ce00..0000000000 --- a/advisories/GLIBC-SA-2025-0003 +++ /dev/null @@ -1,30 +0,0 @@ -power10: strcmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strcmp in -sysdeps/powerpc/powerpc64/le/power10/strcmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strcmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strcmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5702 -Public-Date: 2025-06-04 -Vulnerable-Commit: 3367d8e180848030d1646f088759f02b8dfe0d6f (2.39) -Fix-Commit: 15808c77b35319e67ee0dc8f984a9a1a434701bc (2.42) -Fix-Commit: 0c76c951620f9e12df2a89b2c684878b55bb6795 (2.41-60) -Fix-Commit: 7e12550b8e3a11764a4a9090ce6bd3fc23fc8a8e (2.40-139) -Fix-Commit: 06a70769fd0b2e1f2a3085ad50ab620282bd77b3 (2.39-209) diff --git a/advisories/GLIBC-SA-2025-0004 b/advisories/GLIBC-SA-2025-0004 deleted file mode 100644 index 9409ca27c4..0000000000 --- a/advisories/GLIBC-SA-2025-0004 +++ /dev/null @@ -1,29 +0,0 @@ -power10: strncmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strncmp in -sysdeps/powerpc/powerpc64/le/power10/strncmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strncmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strncmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5745 -Public-Date: 2025-06-05 -Vulnerable-Commit: 23f0d81608d0ca6379894ef81670cf30af7fd081 (2.40) -Fix-Commit: 63c60101ce7c5eac42be90f698ba02099b41b965 (2.42) -Fix-Commit: 84bdbf8a6f2fdafd3661489dbb7f79835a52da82 (2.41-57) -Fix-Commit: 42a5a940c974d02540c8da26d6374c744d148cb9 (2.40-136) diff --git a/advisories/GLIBC-SA-2025-0005 b/advisories/GLIBC-SA-2025-0005 deleted file mode 100644 index 8bcccc59a5..0000000000 --- a/advisories/GLIBC-SA-2025-0005 +++ /dev/null @@ -1,14 +0,0 @@ -posix: Fix double-free after allocation failure in regcomp - -The regcomp function in the GNU C library version from 2.4 to 2.41 is -subject to a double free if some previous allocation fails. It can be -accomplished either by a malloc failure or by using an interposed -malloc that injects random malloc failures. The double free can allow -buffer manipulation depending of how the regex is constructed. -This issue affects all architectures and ABIs supported by the GNU C -library. - -CVE-Id: CVE-2025-8058 -Public-Date: 2025-07-22 -Vulnerable-Commit: 963d8d782fc98fb6dc3a66f0068795f9920c269d (2.3.3-1596) -Fix-Commit: 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d (2.42) diff --git a/advisories/GLIBC-SA-2026-0001 b/advisories/GLIBC-SA-2026-0001 deleted file mode 100644 index 3e0ee3b3f4..0000000000 --- a/advisories/GLIBC-SA-2026-0001 +++ /dev/null @@ -1,41 +0,0 @@ -Integer overflow in memalign leads to heap corruption - -Passing too large an alignment to the memalign suite of functions -(memalign, posix_memalign, aligned_alloc) in the GNU C Library version -2.30 to 2.42 may result in an integer overflow, which could consequently -result in a heap corruption. - -Note that the attacker must have control over both, the size as well as -the alignment arguments of the memalign function to be able to exploit -this. The size parameter must be close enough to PTRDIFF_MAX so as to -overflow size_t along with the large alignment argument. This limits -the malicious inputs for the alignment for memalign to the range [1<<62 -+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. - -Typically the alignment argument passed to such functions is a known -constrained quantity (e.g. page size, block size, struct sizes) and is -not attacker controlled, because of which this may not be easily -exploitable in practice. An application bug could potentially result in -the input alignment being too large, e.g. due to a different buffer -overflow or integer overflow in the application or its dependent -libraries, but that is again an uncommon usage pattern given typical -sources of alignments. - -CVE-Id: CVE-2026-0861 -Public-Date: 2026-01-14 -Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206 (2.30) -Fix-Commit: c9188d333717d3ceb7e3020011651f424f749f93 (2.43) -Fix-Commit: 7f19ef14fbce095d4c77395e258320cad2ea2b28 (2.30-153) -Fix-Commit: f18446d7b4a423090ee5e328c36b3c2a0f26041c (2.31-166) -Fix-Commit: 8aef9e7a7af9565c0324b4ecb38b30dfa3782fd8 (2.32-151) -Fix-Commit: 011293b4fd748cdd6f95874ba2b6aba9a3df8bff (2.33-275) -Fix-Commit: 2c77e52108a58956c9f674b36e1f59a4e3fdcf4d (2.34-525) -Fix-Commit: 499d1ccafccfe64df1b88deea2fa84d8180e8e8f (2.35-399) -Fix-Commit: fb6b8822175769b5794fb6ea04f2895483a29b61 (2.36-244) -Fix-Commit: 7b913d41a07836def826f2164c52541a9835f324 (2.37-172) -Fix-Commit: 744b63026a29f7eedbbc8e3a01a7f48a6eb0a085 (2.38-212) -Fix-Commit: fb22fd3f5b415dd4cd6f7b5741c2f0412374e242 (2.39-286) -Fix-Commit: bfc4dd9e526eacf3017dd8864ba0848e9d045dd4 (2.40-216) -Fix-Commit: 1e2c1ea4307197ccece0cda574bcfebf9080894c (2.41-121) -Fix-Commit: b0ec8fb689df862171f0f78994a3bdeb51313545 (2.42-49) -Reported-by: Igor Morgenstern, Aisle Research diff --git a/advisories/GLIBC-SA-2026-0002 b/advisories/GLIBC-SA-2026-0002 deleted file mode 100644 index f10d8362f6..0000000000 --- a/advisories/GLIBC-SA-2026-0002 +++ /dev/null @@ -1,36 +0,0 @@ -getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler - -Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend for networks and queries for a -zero-valued network in the GNU C Library version 2.0 to version 2.42 -can leak stack contents to the configured DNS resolver. - -A defect in the _nss_dns_getnetbyaddr_r function which implements -getnetbyaddr and getnetbyaddr_r in the dns-based network database can -pass stack contents unmodified to the configured DNS resolver as part of -the network DNS query when the network queried is the default network -i.e. net == 0x0. This stack contents leaking in the query is considered -a loss of confidentiality for the host making the query. Typically it -is rare to call these APIs with a net value of zero, and if an attacker -can control the net value it can only leak adjacent stack, and so loss -of confidentiality is spatially limited. The leak might be used to -accelerate an ASLR bypass by knowing pointer values, but also requires -network adjacent access to snoop between the application and the -DNS server; making the attack complexity higher. - -CVE-Id: CVE-2026-0915 -Public-Date: 2026-01-15 -Vulnerable-Commit: 5f0e6fc702296840d2daa39f83f6cb1e40073d58 (1.92-1) -Fix-Commit: e56ff82d5034ec66c6a78f517af6faa427f65b0b (2.43) -Fix-Commit: 453e6b8dbab935257eb0802b0c97bca6b67ba30e (2.42-50) -Fix-Commit: 15c9839a0b853f552b4ed9047841b6223f3c104d (2.41-122) -Fix-Commit: 329c775788b2c9ff3da774ccf59fba7b6b8ff08e (2.40-217) -Fix-Commit: 831f63b94ceb92fb14c0d1a7ddad35a0d1404c71 (2.39-287) -Fix-Commit: 49125ffc8e1674dc2a100dfdc5b78796f22e16f2 (2.38-213) -Fix-Commit: ddcaed5dfb05b2c1a6ea842fd6b643501365450a (2.37-173) -Fix-Commit: a6bf47887f24b2b394acb301a3189fda04bd4d4d (2.36-245) -Fix-Commit: 66f0cb057c9b4fb1249a5fec6ef4a63511a37899 (2.35-400) -Fix-Commit: 96863dee262225cfb79f9fe45e06fd188319c7b8 (2.34-526) -Fix-Commit: d210011f1536c8322157cbb4fe4229b35c834c08 (2.33-276) -Fix-Commit: 1bc1832cfc74c2a601220969f36e789a5e9f0ebe (2.32-152) -Reported-by: Igor Morgenstern, Aisle Research diff --git a/advisories/GLIBC-SA-2026-0003 b/advisories/GLIBC-SA-2026-0003 deleted file mode 100644 index b7a6e83a10..0000000000 --- a/advisories/GLIBC-SA-2026-0003 +++ /dev/null @@ -1,36 +0,0 @@ -wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory - -Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the -GNU C Library version 2.0 to version 2.42 may cause the interface to -return uninitialized memory in the we_wordv member, which on subsequent -calls to wordfree may abort the process. - -The implementation of WRDE_REUSE in conjunction with WRDE_APPEND fails -to clear the we_wordc member of the structure, and as such, when new -words are added internally, a leading we_wordc count number of entries -are skipped since they are assumed initialized. These skipped entries -are not initialized, but are the contents of a realloc-expanded array of -pointers. If the caller inspects the we_wordv array, it will -dereference invalid pointers and crash. If the caller calls wordfree, -the malloc implementation may detect the invalid pointers and abort the -process. Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never -worked correctly and thus the existence of applications that make use of -this feature is unlikely. - -CVE-Id: CVE-2025-15281 -Public-Date: 2026-01-20 -Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260) -Fix-Commit: 80cc58ea2de214f85b0a1d902a3b668ad2ecb302 (2.43) -Fix-Commit: cbf39c26b25801e9bc88499b4fd361ac172d4125 (2.42-51) -Fix-Commit: fb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 (2.41-123) -Fix-Commit: 9fe8576664d43b87ca19401fb6a975e217e47623 (2.40-218) -Fix-Commit: ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc (2.39-288) -Fix-Commit: d5409a1be010699794264162c551ba60f05ee6c3 (2.38-214) -Fix-Commit: ff2b172803f6bbd897755d2ce83ec4323a1a15b3 (2.37-174) -Fix-Commit: e97cfe2293ed097eb3d0b4c18274d22855e65130 (2.36-246) -Fix-Commit: bb59339d02faebac534a87eea50c83c948f35b77 (2.35-401) -Fix-Commit: 2b656ff94d72f93c84d8da2e7c76456c1994f02e (2.34-527) -Fix-Commit: 1d8ed2067a8a5d162a07670d0d063429679f17a0 (2.33-277) -Fix-Commit: 3a56c4ee4ea49b8f2391a2d8d6220013c4160a79 (2.32-153) -Fix-Commit: 28eb5caf895ced5d895cb02757e109004a2d33e5 (2.31-167) -Reported-by: Vitaly Simonovich diff --git a/advisories/GLIBC-SA-2026-0004 b/advisories/GLIBC-SA-2026-0004 deleted file mode 100644 index fd630dc591..0000000000 --- a/advisories/GLIBC-SA-2026-0004 +++ /dev/null @@ -1,30 +0,0 @@ -nscd client crash on x86_64 under high nscd load - -Calling NSS-backed functions that support caching via nscd may call the -nscd client side code and in the GNU C Library version 2.36 under high -load on x86_64 systems, the client may call memcmp on inputs that are -concurrently modified by other processes or threads and crash. - -The nscd client in the GNU C Library uses the memcmp function with -inputs that may be concurrently modified by another thread, potentially -resulting in spurious cache misses, which in itself is not a security -issue. However in the GNU C Library version 2.36 an optimized -implementation of memcmp was introduced for x86_64 which could crash -when invoked with such undefined behaviour, turning this into a -potential crash of the nscd client and the application that uses it. -This implementation was backported to the 2.35 branch, making the nscd -client in that branch vulnerable as well. Subsequently, the fix for -this issue was backported to all vulnerable branches in the GNU C -Library repository. - -It is advised that distributions that may have cherry-picked the memcpy -SSE2 optimization in their copy of the GNU C Library, also apply the fix -to avoid the potential crash in the nscd client. - -CVE-Id: CVE-2026-3904 -Public-Date: 2026-03-11 -Vulnerable-Commit: 8804157ad9da39631703b92315460808eac86b0c (2.36) -Vulnerable-Commit: 5a8df6485c584e2b0e957ec6b9070437a724911a (2.35-89) -Fix-Commit: b712be52645282c706a5faa038242504feb06db5 (2.37) -Fix-Commit: 93967a2a7bbdcedb73e0b246713580c7c84d001e (2.36-84) -Fix-Commit: 6bcd5d8e3668d52388a6e0580611749f93e6871f (2.35-230) diff --git a/advisories/GLIBC-SA-2026-0005 b/advisories/GLIBC-SA-2026-0005 deleted file mode 100644 index 7a50a43263..0000000000 --- a/advisories/GLIBC-SA-2026-0005 +++ /dev/null @@ -1,37 +0,0 @@ -gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response - -Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend in the GNU C Library version -2.34 to version 2.43 could, with a crafted response from the configured -DNS server, result in a violation of the DNS specification that causes -the application to treat a non-answer section of the DNS response as a -valid answer. - -A defect in the getanswer_ptr function, which implements the iteration -and extraction of the answer from the DNS response, can cause it to -incorrectly transition from the answer section to the next section while -still treating it as an answer to the question. This can happen when -the answer contains only skipped records, and the subsequent section -contains a semantically invalid T_PTR record. This is considered a -security issue because it is a violation of the DNS specification that -leads to incorrect behaviour that could result in the wrong hostname -being returned to the caller. At the time of publication, no known -affected DNS server returns results that would be incorrectly -interpreted by the library. An attacker would either need to be network -adjacent or have compromised the DNS server to use this defect to hide -returned reverse DNS results from intrusion detection systems. Even -then, the inbound connection from the attacker, or the outbound -connection from the application, would be visible to the intrusion -detection system. At best, the defect can be used to obfuscate and -delay analysis of the evolving threat. - -CVE-Id: CVE-2026-4437 -Public-Date: 2026-03-20 -Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) -Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) -Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) -Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) -Fix-Commit: 5c6fca0c62ce5bd6e68e259f138097756cbafd4d (2.43-16) -Fix-Commit: 9f5f18aab40ec6b61fa49a007615e6077e9a979b (2.44) -Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me -Reported-by: Kevin Farrell diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006 deleted file mode 100644 index 1ac70de4d9..0000000000 --- a/advisories/GLIBC-SA-2026-0006 +++ /dev/null @@ -1,27 +0,0 @@ -gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames - -Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend in the GNU C library version -2.34 to version 2.43 could result in an invalid DNS hostname being -returned to the caller in violation of the DNS specification. - -A defect in the getanswer_ptr function, which implements the iteration -and extraction of the answer from a DNS response, can cause it to accept -an invalid DNS hostname that can contain shell metacharacters. An -application that uses the returned hostname in a shell, without guarding -for shell expansion, may be subject to shell injection attacks. At the -time of publication, no known affected DNS server returns results with -shell metacharacters in the results. An attacker would either need to -be network adjacent or have compromised the DNS server to use this -defect for shell injection. No known vulnerable application has been -identified. - -CVE-Id: CVE-2026-4438 -Public-Date: 2026-03-20 -Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) -Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) -Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) -Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) -Fix-Commit: dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718 (2.43-17) -Fix-Commit: e10977481f4db4b2a3ce34fa4c3a1e26651ae312 (2.44) -Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me diff --git a/advisories/GLIBC-SA-2026-0007 b/advisories/GLIBC-SA-2026-0007 deleted file mode 100644 index b880fb5544..0000000000 --- a/advisories/GLIBC-SA-2026-0007 +++ /dev/null @@ -1,15 +0,0 @@ -iconv crash due to assertion failure with untrusted input - -The iconv() function in the GNU C Library versions 2.43 and earlier may -crash due to an assertion failure when converting inputs from the -IBM1390 or IBM1399 character sets, which may be used to remotely crash -an application. - -This vulnerability can be trivially mitigated by removing the IBM1390 -and IBM1399 character sets from systems that do not need them. - -CVE-Id: CVE-2026-4046 -Public-Date: 2026-03-12 -Vulnerable-Commit: 0ecb606cb6cf65de1d9fc8a919bceb4be476c602 (2.3.3-1501) -Fix-Commit: d6f08d1cf027f4eb2ba289a6cc66853722d4badc (2.44) -Reported-by: Rocket Ma diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008 deleted file mode 100644 index 43b38ce38a..0000000000 --- a/advisories/GLIBC-SA-2026-0008 +++ /dev/null @@ -1,22 +0,0 @@ -REJECTED: Static buffer overflow in deprecated nis_local_principal - -REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been -discovered that no NIS+ client or server was ever released for any -Linux-based OS distributions and as such this makes the API provisional -and unused. Secondly it has been discovered that the NIS+ cold start -cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API -can only be called with a trusted server from the pre-populated cache. -The use of a trusted server means no trust boundary is crossed and this -is therefore considered a normal bug. - -NIS+ support in the GNU C Library was never officially supported even -though an incomplete implementation of the APIs was made pulibc. To the -best knowledge of the glibc security team no open-source NIS+ server -implementations were ever released for use with this API. Applications -should not use any of the NIS+ APIs and should move to modern identity -and access management services. - -CVE-Id: CVE-2026-5358 -Public-Date: 2026-04-10 -Rejected-Date: 2026-04-33 -Reported-by: Rahul Hoysala diff --git a/advisories/GLIBC-SA-2026-0009 b/advisories/GLIBC-SA-2026-0009 deleted file mode 100644 index 3c297fdc80..0000000000 --- a/advisories/GLIBC-SA-2026-0009 +++ /dev/null @@ -1,23 +0,0 @@ -scanf %mc off-by-one heap buffer overflow - -Calling the scanf family of functions with a %mc (malloc'd character -match) in the GNU C Library version 2.7 to version 2.43 with a format -width specifier with an explicit width greater than 1024 could result in -a one byte heap buffer overflow. - -The bug is in the buffer growth formula in __vfscanf_internal, which -under-allocates by one byte during realloc expansion, allowing a -controlled single-byte overwrite past the end of the heap buffer. - -The impact is limited by the fact that to execute the overwrite you need -both user controlled input data and a specific choice of maximum width -that yields a smaller than needed allocation. The latter point has to -take into account malloc's particular chunk size rounding process. The -"%[width]mc" format specifier does not appear to have notable use in -major Linux-based OS distributions, due to which the real world impact -may be limited to bespoke use cases. - -CVE-Id: CVE-2026-5450 -Public-Date: 2026-03-19 -Vulnerable-Commit: 874aa52349cc111d1f6ea5dff24bb14c306714e0 (2.7) -Reported-by: Rocket Ma diff --git a/advisories/GLIBC-SA-2026-0010 b/advisories/GLIBC-SA-2026-0010 deleted file mode 100644 index ae9953fb71..0000000000 --- a/advisories/GLIBC-SA-2026-0010 +++ /dev/null @@ -1,24 +0,0 @@ -Potential buffer under-read in ungetwc - -Calling the ungetwc function on a FILE stream with wide characters -encoded in a character set that has overlaps between its single byte and -multi-byte character encodings, in the GNU C Library version 2.43 or -earlier, may result in an attempt to read bytes before an allocated -buffer, potentially resulting in unintentional disclosure of neighboring -data in the heap, or a program crash. - -A bug in the wide character pushback implementation -(_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate -on the regular character buffer (fp->_IO_read_ptr) instead of the actual -wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program -crash may happen in cases where fp->_IO_read_ptr is not initialized and -hence points to NULL. The buffer under-read requires a special situation -where the input character encoding is such that there are overlaps -between single byte representations and multibyte representations in -that encoding, resulting in spurious matches. The spurious match case -is not possible in the standard Unicode character sets. - -CVE-Id: CVE-2026-5928 -Public-Date: 2026-03-17 -Reported-by: Rocket Ma -Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89) diff --git a/advisories/GLIBC-SA-2026-0011 b/advisories/GLIBC-SA-2026-0011 deleted file mode 100644 index e492fa5507..0000000000 --- a/advisories/GLIBC-SA-2026-0011 +++ /dev/null @@ -1,24 +0,0 @@ -Potential buffer overflow in ns_sprintrrf TSIG handling path - -The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the -GNU C Library version 2.2 and newer fail to enforce the caller-supplied -buffer length, and can result in an out-of-bounds write when printing -TSIG records. - -A defect in the TSIG case handling within ns_sprintrrf performs a -formatted write using sprintf without checking the remaining buffer -length, and may write up to 6 bytes past the end of the buffer. If the -library is compiled with assertions, and the out-of-bounds write doesn't -terminate the process, then a subsequent check for "len <= *buflen" will -trigger an assertion failure. - -These functions are for application debugging only and hence not in the -path of code executed by the DNS resolver. Further, they have been -deprecated since version 2.34 (2021-08-02) and should not be used by any -new applications. Applications should consider porting away from these -interfaces since they may be removed in future versions. - -CVE-Id: CVE-2026-5435 -Public-Date: 2026-04-02 -Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2) -Reported-by: shinobu diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012 deleted file mode 100644 index 22071d97a6..0000000000 --- a/advisories/GLIBC-SA-2026-0012 +++ /dev/null @@ -1,18 +0,0 @@ -Buffer overread in ns_printrrf with corrupted RDATA field - -The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the -GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA -content against the RDATA length in a DNS response when processing A6, -CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a -DNS response, causing a target application to crash or read -uninitialized memory. - -These functions are for application debugging only and hence not in the -path of code executed by the DNS resolver. Further, they have been -deprecated since version 2.34 and should not be used by any new -applications. Applications should consider porting away from these -interfaces since they may be removed in future versions. - -CVE-Id: CVE-2026-6238 -Public-Date: 2026-04-11 -Vulnerable-Commit: ee188d555b8c32ad9704a7440cab400af967292f (1.90) diff --git a/advisories/GLIBC-SA-2026-0013 b/advisories/GLIBC-SA-2026-0013 deleted file mode 100644 index 085a853434..0000000000 --- a/advisories/GLIBC-SA-2026-0013 +++ /dev/null @@ -1,20 +0,0 @@ -Potential stack-based buffer clash during tilde expansion in wordexp - -Calling wordexp with a tilde (~) followed by an overly long username -in the GNU C Library version 2.2.3 to 2.43 may lead to a stack buffer -clash. - -When expanding paths that begin with a tilde (~) followed by a username, the -internal parse_tilde function extracts the username to determine the user's -home directory. The implementation allocates memory for this username directly -on the stack using the strndupa macro. Because the size of this allocation -was determined by the length of the user-supplied input without any bounds -checks, passing an excessively long username e.g. thousands of characters, -forces the thread to exhaust its stack space. Thus if an application passes -untrusted, attacker-controlled input to the wordexp function, an attacker -can trigger a stack clash. - -CVE-Id: CVE-2026-6791 -Public-Date: 2026-06-22 -Vulnerable-Commit: 344af000e1d6e9c7882b9bc48e71cb3f1b5fc03c (2.2.3-114) -Reported-by: storm diff --git a/advisories/GLIBC-SA-2026-0014 b/advisories/GLIBC-SA-2026-0014 deleted file mode 100644 index 1e9a0039f0..0000000000 --- a/advisories/GLIBC-SA-2026-0014 +++ /dev/null @@ -1,19 +0,0 @@ -wordexp with WRDE_APPEND may result in an invalid call to free() - -Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion -(where an error like WRDE_BADCHAR would be returned) can create a stale -address in the wordexp_t that can cause an invalid free from wordfree. -This affects the GNU C Library version 2.0 to version 2.43. - -In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state -before appending the processing input. If the word expansion grows -we_wordv via realloc, and realloc requires moving we_wordv to a new memory -location (instead of expanding in-place), and the expansion later fails, -the rollback fails to properly restore all previous we_wordv values and -may add stale pointers into the caller-visible state. A subsequent -wordfree may then issue an invalid call to free(). - -CVE-Id: CVE-2026-6368 -Public-Date: 2026-07-14 -Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260) -Reported-by: shinobu diff --git a/advisories/README b/advisories/README deleted file mode 100644 index 330a31dff3..0000000000 --- a/advisories/README +++ /dev/null @@ -1,92 +0,0 @@ -GNU C Library Security Advisory Format -====================================== - -Security advisories in this directory follow a simple git commit log -format, with a heading and free-format description augmented with tags -to allow parsing key information. References to code changes are -specific to the glibc repository and follow a specific format: - - Tag-name: (release-version) - -The indicates a specific commit in the repository. The -release-version indicates the publicly consumable release in which this -commit is known to exist. The release-version is derived from the -git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and -is of the form 2.34-NNN. If the -NNN suffix is absent, it means that -the change is in that release tarball, otherwise the change is on the -release/2.YY/master branch and not in any released tarball. - -The following tags are currently being used: - -CVE-Id: -This is the CVE-Id assigned under the CVE Program -(https://www.cve.org/). - -Public-Date: -The date this issue became publicly known. - -Rejected-Date: -The most recent date the assigned advisory was rejected. If the advisory -is ever published again the Rejected-Date tag should be removed. - -Vulnerable-Commit: -The commit that introduced this vulnerability. There could be multiple -entries, one for each release branch in the glibc repository; the -release-version portion of this tag should tell you which branch this is -on. - -Fix-Commit: -The commit that fixed this vulnerability. There could be multiple -entries for each release branch in the glibc repository, indicating that -all of those commits contributed to fixing that issue in each of those -branches. - -Reported-By: -The entity that reported this issue. There could be multiple entries, one for -each reporter. - -Adding an Advisory ------------------- - -An advisory for a CVE needs to be added on the master branch in two steps: - -1. Add the text of the advisory without any Fix-Commit tags along with - the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. - The advisories directory does not exist in release branches, so keep - the advisory text commit distinct from the code changes, to ease - backports. Ask for the GLIBC-SA advisory number from the security - team. - -2. Finish all backports on release branches and then back on the msater - branch, add all commit refs to the advisory using the Fix-Commit - tags. Don't bother adding the release-version subscript since the - next step will overwrite it. - -3. Run the process-advisories.sh script in the scripts directory on the - advisory: - - scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN - - (replace YYYY-NNNN with the actual advisory number). - -4. Verify the updated advisory and push the result. - -Rejecting an Advisory ---------------------- - -Rejecting an advisory on the master branch can be done in one step: - -1. Mark the advisory as rejected. Add the text "REJECTED: " as a prefix - to any short-form description. Add a new paragraph that starts with - "REJECTED: " and explains the reason for the rejection including - justification for why it no longer has security impact. Lastly add - a Rejected-Date tag to the advisory. - -Getting a NEWS snippet from advisories --------------------------------------- - -Run: - - scripts/process-advisories.sh news - -and copy the content into the NEWS file. -- 2.55.0 From 1bd79651065b27c02c6502b9423124e54882058d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20K=2E=20H=C3=BCttel?= Date: Sat, 25 Jul 2026 09:21:33 +0900 Subject: [PATCH 02/49] NEWS: start 2.44.1 section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Andreas K. Hüttel --- NEWS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/NEWS b/NEWS index ee28fadf49..1043343d70 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,10 @@ See the end for copying conditions. Please send GNU C library bug reports via using `glibc' in the "product" field. +Version 2.44.1 + +The following bugs are resolved with this release: + Version 2.44 Major new features: -- 2.55.0 From 0b05bc142249ac47e72be5cad5c37f33f4bb68d4 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Fri, 24 Jul 2026 23:10:02 +0200 Subject: [PATCH 03/49] hurd: Make the readlink __fstatat64 references optional They may show up or not depending on the toolchain in use. --- sysdeps/mach/hurd/i386/localplt.data | 4 ++-- sysdeps/mach/hurd/x86_64/localplt.data | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sysdeps/mach/hurd/i386/localplt.data b/sysdeps/mach/hurd/i386/localplt.data index 2befcd3748..5b9413422d 100644 --- a/sysdeps/mach/hurd/i386/localplt.data +++ b/sysdeps/mach/hurd/i386/localplt.data @@ -25,14 +25,14 @@ ld.so: __writev ld.so: __libc_lseek64 ld.so: __mmap ld.so: __fstat64 -ld.so: __fstatat64 +ld.so: __fstatat64 ? ld.so: __stat64 ld.so: __access ld.so: __getpid ld.so: __getcwd ld.so: _exit ? ld.so: abort -ld.so: readlink +ld.so: readlink ? ld.so: _hurd_intr_rpc_mach_msg ld.so: __errno_location ld.so: _dl_init_first diff --git a/sysdeps/mach/hurd/x86_64/localplt.data b/sysdeps/mach/hurd/x86_64/localplt.data index fda28cd983..cc39118d12 100644 --- a/sysdeps/mach/hurd/x86_64/localplt.data +++ b/sysdeps/mach/hurd/x86_64/localplt.data @@ -24,14 +24,14 @@ ld.so: __writev ld.so: __libc_lseek64 ld.so: __mmap ld.so: __fstat64 -ld.so: __fstatat64 +ld.so: __fstatat64 ? ld.so: __stat64 ld.so: __access ld.so: __getpid ld.so: __getcwd ld.so: _exit ? ld.so: abort -ld.so: readlink +ld.so: readlink ? ld.so: _hurd_intr_rpc_mach_msg ld.so: __errno_location ld.so: _dl_init_first -- 2.55.0 From c045fc61e8435c103ebfe06d01fec7f56503e2b4 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Mon, 27 Jul 2026 00:59:36 +0200 Subject: [PATCH 04/49] hurd: fix fork's longjmp demangling on i386 i386's setjmp does not actually mangle ebp. --- sysdeps/mach/hurd/i386/longjmp-ts.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sysdeps/mach/hurd/i386/longjmp-ts.c b/sysdeps/mach/hurd/i386/longjmp-ts.c index 93450e86b4..340104b832 100644 --- a/sysdeps/mach/hurd/i386/longjmp-ts.c +++ b/sysdeps/mach/hurd/i386/longjmp-ts.c @@ -38,7 +38,6 @@ _hurd_longjmp_thread_state (void *state, jmp_buf env, int val) ts->eip = env[0].__jmpbuf[JB_PC]; ts->eax = val ?: 1; - PTR_DEMANGLE (ts->ebp); PTR_DEMANGLE (ts->uesp); PTR_DEMANGLE (ts->eip); } -- 2.55.0 From 7cba77790f3279bec3ac20e9c7632b021cd53f95 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 27 Jul 2026 13:37:19 -0300 Subject: [PATCH 05/49] math: Fix sinh worst-case results for |x| > 36.736801 [BZ 34441] The CORE-MATH import mistranslated the accurate path result scaling 'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed68), and two of the 51 exceptional-case table entries were dropped when the table was moved to e_sinh_data.c (commit f05c4907a27). Checked on x86_64-linux-gnu and aarch64-linux-gnu. (cherry picked from commit fdc90dbb52b092f68cd5a4fac7a4cbd854c91bc3) --- NEWS | 3 + math/auto-libm-test-in | 8 + math/auto-libm-test-out-sinh | 552 +++++++++++++++++++++++++++ sysdeps/ieee754/dbl-64/e_sinh.c | 2 +- sysdeps/ieee754/dbl-64/e_sinh_data.c | 4 +- sysdeps/ieee754/dbl-64/e_sinh_data.h | 2 +- 6 files changed, 568 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 1043343d70..fe2b1d7f79 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,9 @@ using `glibc' in the "product" field. Version 2.44.1 The following bugs are resolved with this release: + + [34441] math: math: sinh() returns wrong results for some inputs with + |x| > 36.736801 Version 2.44 diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in index ca670768a2..5c4d486af4 100644 --- a/math/auto-libm-test-in +++ b/math/auto-libm-test-in @@ -9661,6 +9661,14 @@ sinh 0x2.c5d37700c6bb03a6c24b6c9b494cp+12 sinh 0x2.c5d37700c6bb03a6c24b6c9b494ep+12 # the next value generates larger error bounds on x86_64 (binary64) sinh -0x1.633c62890fa14p+9 +sinh 0x1.2b4f4e0bb49c9p+5 +sinh -0x1.2b4f4e0bb49c9p+5 +sinh 0x1.2ac43fb6d3abap+5 +sinh -0x1.2ac43fb6d3abap+5 +sinh 0x1.b7efa91915c95p-2 +sinh -0x1.b7efa91915c95p-2 +sinh 0x1.92a5c27afbe82p+4 +sinh -0x1.92a5c27afbe82p+4 sinpi 0 sinpi -0 diff --git a/math/auto-libm-test-out-sinh b/math/auto-libm-test-out-sinh index f96252b91c..91ab5c19fa 100644 --- a/math/auto-libm-test-out-sinh +++ b/math/auto-libm-test-out-sinh @@ -6466,3 +6466,555 @@ sinh -0x1.633c62890fa14p+9 = sinh tonearest ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok = sinh towardzero ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok = sinh upward ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok +sinh 0x1.2b4f4e0bb49c9p+5 += sinh downward binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh tonearest binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh towardzero binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh upward binary32 0x2.569eap+4 : 0x1.f7c30cp+52 : inexact-ok += sinh downward binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok += sinh tonearest binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok += sinh towardzero binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok += sinh upward binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok += sinh downward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh tonearest intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh downward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh tonearest m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh downward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh tonearest binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh towardzero binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh upward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok += sinh downward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh tonearest ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh towardzero ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh upward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh downward binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh tonearest binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh towardzero binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh upward binary32 0x2.569e9cp+4 : 0x1.f7c28ep+52 : inexact-ok += sinh downward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok += sinh tonearest binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok += sinh towardzero binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok += sinh upward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok += sinh downward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh tonearest intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh downward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh tonearest m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh downward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh tonearest binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh towardzero binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh upward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok += sinh downward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh tonearest ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh towardzero ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh upward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh downward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh tonearest binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh towardzero binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh upward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh downward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh tonearest intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh downward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh tonearest m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh downward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh tonearest binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh towardzero binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh upward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh downward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh tonearest ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh towardzero ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh upward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok +sinh -0x1.2b4f4e0bb49c9p+5 += sinh downward binary32 -0x2.569e9cp+4 : -0x1.f7c28ep+52 : inexact-ok += sinh tonearest binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh towardzero binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh upward binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh downward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok += sinh tonearest binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok += sinh towardzero binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok += sinh upward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok += sinh downward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh tonearest intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh downward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh tonearest m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh downward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok += sinh tonearest binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh towardzero binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh upward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh downward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh upward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh downward binary32 -0x2.569eap+4 : -0x1.f7c30cp+52 : inexact-ok += sinh tonearest binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh towardzero binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh upward binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh downward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok += sinh tonearest binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok += sinh towardzero binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok += sinh upward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok += sinh downward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh tonearest intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh downward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh tonearest m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh downward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok += sinh tonearest binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh towardzero binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh upward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh downward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh upward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh downward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh tonearest binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh towardzero binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh upward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh downward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh tonearest intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh downward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh tonearest m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh downward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh tonearest binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh towardzero binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh upward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh downward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh upward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok +sinh 0x1.2ac43fb6d3abap+5 += sinh downward binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh tonearest binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh towardzero binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh upward binary32 0x2.55888p+4 : 0x1.d6b0eep+52 : inexact-ok += sinh downward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh tonearest binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh towardzero binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh upward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c3p+52 : inexact-ok += sinh downward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh tonearest intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok += sinh downward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh tonearest m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok += sinh downward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh tonearest binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh towardzero binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh upward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok += sinh downward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh tonearest ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh towardzero ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh upward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh downward binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok += sinh tonearest binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok += sinh towardzero binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok += sinh upward binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok += sinh downward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh tonearest binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh towardzero binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh upward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b3p+52 : inexact-ok += sinh downward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh tonearest intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok += sinh downward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh tonearest m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok += sinh downward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh tonearest binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh towardzero binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh upward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok += sinh downward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh tonearest ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh towardzero ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh upward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh downward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh tonearest binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh upward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh tonearest intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh tonearest m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh tonearest binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh towardzero binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh upward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok += sinh downward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh tonearest ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh towardzero ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh upward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok +sinh -0x1.2ac43fb6d3abap+5 += sinh downward binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok += sinh tonearest binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok += sinh towardzero binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok += sinh upward binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok += sinh downward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b3p+52 : inexact-ok += sinh tonearest binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh towardzero binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh upward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh downward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok += sinh tonearest intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh downward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok += sinh tonearest m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh downward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok += sinh tonearest binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh towardzero binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh upward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh downward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh upward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh downward binary32 -0x2.55888p+4 : -0x1.d6b0eep+52 : inexact-ok += sinh tonearest binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh towardzero binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh upward binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh downward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c3p+52 : inexact-ok += sinh tonearest binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh towardzero binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh upward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh downward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok += sinh tonearest intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh downward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok += sinh tonearest m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh downward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok += sinh tonearest binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh towardzero binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh upward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh downward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh upward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh downward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh upward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh downward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh downward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh downward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok += sinh tonearest binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh towardzero binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh upward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh downward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh upward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok +sinh 0x1.b7efa91915c95p-2 += sinh downward binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh tonearest binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh towardzero binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh upward binary32 0x6.dfbea8p-4 : 0x7.1661bp-4 : inexact-ok += sinh downward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok += sinh towardzero binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok += sinh upward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok += sinh downward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok += sinh downward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok += sinh downward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh upward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh downward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh upward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ecp-4 : inexact-ok += sinh downward binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh tonearest binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh towardzero binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh upward binary32 0x6.dfbeap-4 : 0x7.1661a8p-4 : inexact-ok += sinh downward binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok += sinh towardzero binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok += sinh upward binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok += sinh downward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok += sinh downward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok += sinh downward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh upward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok += sinh downward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh upward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok += sinh downward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok += sinh upward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh upward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh downward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh upward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok +sinh -0x1.b7efa91915c95p-2 += sinh downward binary32 -0x6.dfbeap-4 : -0x7.1661a8p-4 : inexact-ok += sinh tonearest binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh towardzero binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh upward binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh downward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok += sinh upward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok += sinh downward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh downward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh upward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh upward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh downward binary32 -0x6.dfbea8p-4 : -0x7.1661bp-4 : inexact-ok += sinh tonearest binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh towardzero binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh upward binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh downward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok += sinh upward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok += sinh downward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh downward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh upward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ecp-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh upward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh downward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok += sinh upward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok += sinh downward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh downward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh upward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh upward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok +sinh 0x1.92a5c27afbe82p+4 += sinh downward binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok += sinh tonearest binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok += sinh towardzero binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok += sinh upward binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok += sinh downward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh upward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c858p+32 : inexact-ok += sinh downward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh downward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh downward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh upward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok += sinh downward binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh tonearest binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh towardzero binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh upward binary32 0x1.92a5c2p+4 : 0x9.e40f9p+32 : inexact-ok += sinh downward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok += sinh upward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok += sinh downward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh downward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh downward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh upward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok += sinh downward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392ap+32 : inexact-ok += sinh downward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok += sinh downward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok += sinh downward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh upward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392980000000000024p+32 : inexact-ok +sinh -0x1.92a5c27afbe82p+4 += sinh downward binary32 -0x1.92a5c2p+4 : -0x9.e40f9p+32 : inexact-ok += sinh tonearest binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh towardzero binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh upward binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh downward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok += sinh upward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok += sinh downward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh downward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh downward binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok += sinh tonearest binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok += sinh towardzero binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok += sinh upward binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok += sinh downward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c858p+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh upward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh downward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh downward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh downward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392ap+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392980000000000024p+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok diff --git a/sysdeps/ieee754/dbl-64/e_sinh.c b/sysdeps/ieee754/dbl-64/e_sinh.c index 1643f3f504..638e3d6a6d 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh.c +++ b/sysdeps/ieee754/dbl-64/e_sinh.c @@ -213,7 +213,7 @@ __sinh (double x) ml = (ul + 8) & MANTISSA_MASK; th += tl; th *= 2; - th *= asuint64 (sp); + th *= sp; if (ml <= 16 || eh - el > 103) return as_sinh_database (x, th); return th; diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.c b/sysdeps/ieee754/dbl-64/e_sinh_data.c index ca61e311f1..d4fd41d934 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh_data.c +++ b/sysdeps/ieee754/dbl-64/e_sinh_data.c @@ -35,12 +35,13 @@ const double __sinh_data_ch[][2] = { 0x1.ae64567f54482p-26, -0x1.defcf17a6ab79p-81 } }; -const double __sinh_data_db[49][3] = +const double __sinh_data_db[51][3] = { { 0x1.364303e1ad8f6p-2, 0x1.3b07e0c779ddap-2, -0x1.bcp-106 }, { 0x1.4169f234f23b9p-2, 0x1.46b7b3b358f99p-2, -0x1p-56 }, { 0x1.616cc75d49226p-2, 0x1.687bd068c1c1ep-2, 0x1.ap-111 }, { 0x1.ae3773250e7d2p-2, 0x1.bafc3479fc9ccp-2, -0x1p-105 }, + { 0x1.b7efa91915c95p-2, 0x1.c59869f17b483p-2, -0x1p-104 }, { 0x1.d68039861ab53p-2, 0x1.e73b46abb01e1p-2, -0x1.2p-109 }, { 0x1.e90f16eb88c09p-2, 0x1.fbdd4a37760b7p-2, -0x1.f8p-108 }, { 0x1.a3fc7e4dd47d1p-1, 0x1.d4b21ebf542fp-1, 0x1.ep-107 }, @@ -62,6 +63,7 @@ const double __sinh_data_db[49][3] = { 0x1.43a81752eabe7p+3, 0x1.81d364845ecfap+13, -0x1p-90 }, { 0x1.16369cd53bb69p+4, 0x1.0fbc6c02b1c9p+24, -0x1.9p-81 }, { 0x1.20e29ea8b51e2p+4, 0x1.08b8abba28abcp+25, 0x1.9bp-79 }, + { 0x1.92a5c27afbe82p+4, 0x1.3c81f9a247253p+35, 0x1p-67 }, { 0x1.a1e4f11b513d7p+4, 0x1.9a65b6c2e2185p+36, -0x1.bcp-70 }, { 0x1.c089fcf166171p+4, 0x1.5c452e0e37569p+39, 0x1.4p-69 }, { 0x1.e42a98b3a0be5p+4, 0x1.938768ca4f8aap+42, 0x1.6dp-62 }, diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.h b/sysdeps/ieee754/dbl-64/e_sinh_data.h index 16f7e0da5a..c34848fd54 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh_data.h +++ b/sysdeps/ieee754/dbl-64/e_sinh_data.h @@ -29,7 +29,7 @@ SOFTWARE. extern const double __sinh_data_ch[][2] attribute_hidden; #define CH __sinh_data_ch -extern const double __sinh_data_db[49][3] attribute_hidden; +extern const double __sinh_data_db[51][3] attribute_hidden; #define DB __sinh_data_db #endif -- 2.55.0 From 0b58f5d80d24cf83cfde9d8381aafb11fef0e152 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 30 Jul 2026 08:55:54 -0300 Subject: [PATCH 06/49] math: Fix x86_64 tanh _FloatN aliases binding to the FMA variant [BZ 34465] The generic implementation emits libm_alias_double unconditionally, so tanhf32x and tanhf64 bind directly to __tanh_fma. Guard the alias with '#ifndef __tanh' and emit it from the dispatcher, as sin. Also remove the stale __expm1 defines, unused since tanh moved to CORE-MATH. Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'. Reported-by: Michael Brunnbauer (cherry picked from commit b01abba04a954cbd6b2834c0643a08685a915fe5) --- NEWS | 1 + sysdeps/ieee754/dbl-64/s_tanh.c | 2 ++ sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c | 6 ------ sysdeps/x86_64/fpu/multiarch/s_tanh.c | 5 ++--- 4 files changed, 5 insertions(+), 9 deletions(-) diff --git a/NEWS b/NEWS index fe2b1d7f79..43667c1963 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ The following bugs are resolved with this release: [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 + [34465] math: math: x86_64 tanh ifunc selection wrong Version 2.44 diff --git a/sysdeps/ieee754/dbl-64/s_tanh.c b/sysdeps/ieee754/dbl-64/s_tanh.c index 2029de8fa5..ef80b9edb6 100644 --- a/sysdeps/ieee754/dbl-64/s_tanh.c +++ b/sysdeps/ieee754/dbl-64/s_tanh.c @@ -283,4 +283,6 @@ __tanh (double x) return as_tanh_database (x, res); return res; } +#ifndef __tanh libm_alias_double (__tanh, tanh) +#endif diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c index 1b808b1227..1e6b33740a 100644 --- a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c +++ b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c @@ -1,10 +1,4 @@ #define __tanh __tanh_fma -#define __expm1 __expm1_fma - -/* NB: __expm1 may be expanded to __expm1_fma in the following - prototypes. */ -extern long double __expm1l (long double); -extern long double __expm1f128 (long double); #define SECTION __attribute__ ((section (".text.fma"))) diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh.c b/sysdeps/x86_64/fpu/multiarch/s_tanh.c index ec8826f634..9048c977c1 100644 --- a/sysdeps/x86_64/fpu/multiarch/s_tanh.c +++ b/sysdeps/x86_64/fpu/multiarch/s_tanh.c @@ -25,10 +25,9 @@ extern double __redirect_tanh (double); # define SYMBOL_NAME tanh # include "ifunc-fma.h" -libc_ifunc_redirected (__redirect_tanh, tanh, IFUNC_SELECTOR ()); +libc_ifunc_redirected (__redirect_tanh, __tanh, IFUNC_SELECTOR ()); +libm_alias_double (__tanh, tanh) # define __tanh __tanh_sse2 -# undef libm_alias_double -# define libm_alias_double(a, b) #endif #include -- 2.55.0 From 9bcb85688e58847191deb42bfc68d60802078df4 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Wed, 22 Jul 2026 19:26:10 +0800 Subject: [PATCH 07/49] io: fix ftw ABI on MIPS n64 On MIPS n64 off_t is same as off64_t, but struct stat is not same as struct stat64 (very peculiar but see the "as tempting as it..." comment in linux/mips/kernel_stat.h). As the ftw/ftw64 callback accepts a pointer to a function who accepts struct stat/stat64, for MIPS n64 we must use different implementations for ftw and ftw64. Thus for testing if ftw64 can be aliased to ftw, we should check XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T. This resolves the io/tst-ftw-lnk failure observed on MIPS n64. Link: https://sourceware.org/glibc/wiki/Testing/Tests/io/tst-ftw-lnk Signed-off-by: Xi Ruoyao Reviewed-by: Adhemerval Zanella (cherry picked from commit 6758def717175e679cb49b5051b6b5ec54ddfb2c) --- io/ftw.c | 4 +++- io/ftw64.c | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/io/ftw.c b/io/ftw.c index ed0eeb3904..a9368a706e 100644 --- a/io/ftw.c +++ b/io/ftw.c @@ -18,7 +18,9 @@ #include -#ifndef __OFF_T_MATCHES_OFF64_T +#include + +#if !XSTAT_IS_XSTAT64 # include "ftw-common.c" versioned_symbol (libc, __new_nftw, nftw, GLIBC_2_3_3); diff --git a/io/ftw64.c b/io/ftw64.c index d3cd14c21a..fa7b05df22 100644 --- a/io/ftw64.c +++ b/io/ftw64.c @@ -31,6 +31,9 @@ #define ftw __rename_ftw #define nftw __rename_nftw +#include + +#include #include #include "ftw-common.c" @@ -44,7 +47,7 @@ versioned_symbol (libc, __new_nftw64, nftw64, GLIBC_2_3_3); compat_symbol (libc, __old_nftw64, nftw64, GLIBC_2_1); #endif -#ifdef __OFF_T_MATCHES_OFF64_T +#if XSTAT_IS_XSTAT64 weak_alias (__ftw64, ftw) versioned_symbol (libc, __new_nftw64, nftw, GLIBC_2_3_3); # if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_3_3) -- 2.55.0 From 58da792d8a2d8f2fe711318836e853fcddfd7cd8 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Tue, 4 Aug 2026 14:25:48 +0000 Subject: [PATCH 08/49] hurd: Fix build after the ftw kernel_stat.h inclusion Commit 6758def7171 changed the generic ftw{64}.c to include kernel_stat.h, which is Linux specific. Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0, since struct stat and struct stat64 never share a layout on Hurd: on 32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and on 64-bit ABIs the two structures still differ in size because _SPARE_SIZE in bits/stat.h reserves three more ints of spare space in struct stat than in struct stat64. This keeps the ftw/ftw64 symbols exactly as before the change, where the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because the Hurd bits/typesizes.h does not define it. Checked with a full build for i686-gnu and x86_64-gnu. (cherry picked from commit d6031665c3a59faf75cf6bc55e041611da21d0e6) --- sysdeps/mach/hurd/kernel_stat.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 sysdeps/mach/hurd/kernel_stat.h diff --git a/sysdeps/mach/hurd/kernel_stat.h b/sysdeps/mach/hurd/kernel_stat.h new file mode 100644 index 0000000000..aa8c26b1d9 --- /dev/null +++ b/sysdeps/mach/hurd/kernel_stat.h @@ -0,0 +1,23 @@ +/* Internal definitions for stat functions. Hurd version. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* struct stat and struct stat64 never have the same layout: on 32-bit + ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and + on 64-bit ABIs the two structures still differ in the amount of + trailing spare space (see _SPARE_SIZE in bits/stat.h). */ +#define XSTAT_IS_XSTAT64 0 -- 2.55.0 From fec2a9c6765b548f9d738e3a1c63a63ad7061d40 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Fri, 21 Mar 2025 14:03:00 +0000 Subject: [PATCH 09/49] linux: Inline syscall cancellation to keep wrapper frames observable (BZ 34338) The cancellable syscall wrappers end with a tail call to __syscall_cancel, the wrapper frame is then elided, so when the syscall executes the wrapper is no longer present on the stack. Tools that unwind from CFI alone, such as valgrind, perf and sampling profilers, cannot observe it. On gdb, it only recovers it from DWARF call site information, which reduced-debuginfo libc builds usually omit. The behaviour is target dependent: for a shared (PIC) the tail call is emitted on aarch64, arc, loongarch and riscv. It is not emitted on i386, x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed on the stack or fewer argument registers are available, nor on powerpc and mips, where the TOC/GOT pointer must be restored after the call. This is why the problem was originally reported as aarch64 specific while x86_64 was unaffected. Rather than only inhibiting the tail call [1] (which keeps the wrapper frame but still leaves the __syscall_cancel and __internal_syscall_cancel frames), move the cancellation logic back into the wrappers. In the single-threaded case the syscall is now issued directly from the wrapper; only the multi-threaded path still calls the out-of-line __syscall_cancel_arch. This keeps the wrapper observable and removes the extra frames, mimicking how cancellation was handled before 89b53077d2a58f00e7debdfe58afabe953dac60d. The result is a small libc.so .text increase (size, first column): ABI master patched diff increase aarch64 1635880 1647424 11544 0.71% x86_64 1981081 1992257 11176 0.56% powerpc64le 2364336 2376964 12628 0.53% riscv64 1368386 1376704 8318 0.61% loongarch64 1741385 1755601 14216 0.82% The tst-backtrace5 was suppose to track this issue, but due wrong loop variable check it does not take this in account. This patch also fixes it. Checked on aarch64-linux-gnu, x86_64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, and powerpc64le-linux-gnu. [1] https://sourceware.org/pipermail/libc-alpha/2025-March/165395.html (cherry picked from commit 1b5ff009fa5bf01ad26e6cc330a1df5a0c84135e) --- NEWS | 2 + debug/tst-backtrace5.c | 32 ++++++---- elf/Makefile | 4 +- nptl/cancellation.c | 60 ------------------ nptl/futex-internal.c | 2 +- nptl/sem_waitcommon.c | 2 +- sysdeps/unix/sysdep.h | 81 +++++++++++-------------- sysdeps/unix/sysv/linux/epoll_pwait2.c | 2 +- sysdeps/unix/sysv/linux/recvmmsg.c | 2 +- sysdeps/unix/sysv/linux/sigtimedwait.c | 2 +- sysdeps/unix/sysv/linux/sysdep-cancel.h | 61 +++++++++++++++++++ 11 files changed, 127 insertions(+), 123 deletions(-) diff --git a/NEWS b/NEWS index 43667c1963..28fbd9bcd8 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,8 @@ Version 2.44.1 The following bugs are resolved with this release: + [34338] libc: Cancellable syscall wrappers are missing from backtraces + because they tail-call __syscall_cancel [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong diff --git a/debug/tst-backtrace5.c b/debug/tst-backtrace5.c index 4c5784c060..6538da9ab5 100644 --- a/debug/tst-backtrace5.c +++ b/debug/tst-backtrace5.c @@ -36,10 +36,15 @@ trampoline, read, 3 * fn, and do_test. */ #define NUM_FUNCTIONS 7 +/* Avoid the read wrapper frame truncation on targets that add extra frames + between it and handle_signal (the cancellable syscall wrappers + __syscall_cancel*, or the i686 __kernel_vsyscall entry). */ +#define MAX_FUNCTIONS 64 + void handle_signal (int signum) { - void *addresses[NUM_FUNCTIONS]; + void *addresses[MAX_FUNCTIONS]; char **symbols; int n; int i; @@ -70,23 +75,28 @@ handle_signal (int signum) return; } - /* Do not check name for signal trampoline or cancellable syscall - wrappers (__syscall_cancel*). */ - for (; i < n - 1; i++) + /* Skip the signal trampoline and any cancellable syscall wrapper frames + (__syscall_cancel*) and require the read syscall wrapper to be + present. */ + for (i = 1; i < n; i++) if (match (symbols[i], "read")) break; - if (i == n - 1) + if (i == n) { FAIL (); return; } - for (; i < n - 1; i++) - if (!match (symbols[i], "fn")) - { - FAIL (); - return; - } + /* The read wrapper must be followed by the three fn recursion frames. */ + for (int j = 0; j < 3; j++) + { + i++; + if (i == n || !match (symbols[i], "fn")) + { + FAIL (); + return; + } + } /* Symbol names are not available for static functions, so we do not check do_test. */ diff --git a/elf/Makefile b/elf/Makefile index 94c5b7e6ed..8b063e1bba 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -1574,7 +1574,9 @@ $(objpfx)dl-allobjs.os: $(all-rtld-routines:%=$(objpfx)%.os) # when compiled for libc. rtld-stubbed-symbols = \ __libc_assert_fail \ - __syscall_cancel \ + __libc_single_threaded_internal \ + __syscall_cancel_arch \ + __syscall_do_cancel \ calloc \ free \ malloc \ diff --git a/nptl/cancellation.c b/nptl/cancellation.c index 4368cb7231..63f09840ff 100644 --- a/nptl/cancellation.c +++ b/nptl/cancellation.c @@ -19,66 +19,6 @@ #include #include "pthreadP.h" -/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and - returns the syscall value or its negative error code. */ -long int -__internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) -{ - long int result; - struct pthread *pd = THREAD_SELF; - - /* If cancellation is not enabled, call the syscall directly and also - for thread terminatation to avoid call __syscall_do_cancel while - executing cleanup handlers. */ - int ch = atomic_load_relaxed (&pd->cancelhandling); - if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch)) - { - result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6 - __SYSCALL_CANCEL7_ARCH_ARG7); - if (INTERNAL_SYSCALL_ERROR_P (result)) - return -INTERNAL_SYSCALL_ERRNO (result); - return result; - } - - /* Call the arch-specific entry points that contains the globals markers - to be checked by SIGCANCEL handler. */ - result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5, - a6 __SYSCALL_CANCEL7_ARCH_ARG7); - - /* If the cancellable syscall was interrupted by SIGCANCEL and it has no - side-effect, cancel the thread if cancellation is enabled. */ - ch = atomic_load_relaxed (&pd->cancelhandling); - /* The behaviour here assumes that EINTR is returned only if there are no - visible side effects. POSIX Issue 7 has not yet provided any stronger - language for close, and in theory the close syscall could return EINTR - and leave the file descriptor open (conforming and leaks). It expects - that no such kernel is used with glibc. */ - if (result == -EINTR && cancel_enabled_and_canceled (ch)) - __syscall_do_cancel (); - - return result; -} - -/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the - syscall expected success value (usually 0) or, in case of failure, -1 and - sets errno to syscall return value. */ -long int -__syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr) -{ - long int r = __internal_syscall_cancel (a1, a2, a3, a4, a5, a6, - __SYSCALL_CANCEL7_ARG nr); - return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r)) - ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r)) - : r; -} - /* Called by __syscall_cancel_arch or function above start the thread cancellation. */ _Noreturn void diff --git a/nptl/futex-internal.c b/nptl/futex-internal.c index fc6b11c8ad..07f1462abe 100644 --- a/nptl/futex-internal.c +++ b/nptl/futex-internal.c @@ -17,7 +17,7 @@ . */ #include -#include +#include #include #include #include diff --git a/nptl/sem_waitcommon.c b/nptl/sem_waitcommon.c index b0cbe5cebf..82c686f020 100644 --- a/nptl/sem_waitcommon.c +++ b/nptl/sem_waitcommon.c @@ -18,7 +18,7 @@ #include #include -#include +#include #include #include #include diff --git a/sysdeps/unix/sysdep.h b/sysdeps/unix/sysdep.h index a6ce5348ec..f0f271ec02 100644 --- a/sysdeps/unix/sysdep.h +++ b/sysdeps/unix/sysdep.h @@ -154,42 +154,31 @@ # define __SYSCALL_CANCEL7_ARG7 # define __SYSCALL_CANCEL7_ARCH_ARG7 #endif -long int __internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) attribute_hidden; - -long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2, - __syscall_arg_t arg3, __syscall_arg_t arg4, - __syscall_arg_t arg5, __syscall_arg_t arg6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) attribute_hidden; #define __SYSCALL_CANCEL0(name) \ - __syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL1(name, a1) \ - __syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL2(name, a1, a2) \ - __syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL3(name, a1, a2, a3) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL4(name, a1, a2, a3, a4) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4), \ - __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4), \ + __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ - __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG \ - __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ + __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG \ + __NR_##name) #define __SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ - __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ + __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name) #define __SYSCALL_CANCEL_NARGS_X(a,b,c,d,e,f,g,h,n,...) n #define __SYSCALL_CANCEL_NARGS(...) \ @@ -206,33 +195,33 @@ long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2, __SYSCALL_CANCEL_DISP (__SYSCALL_CANCEL, __VA_ARGS__) #define __INTERNAL_SYSCALL_CANCEL0(name) \ - __internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG \ + internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG \ __NR_##name) #define __INTERNAL_SYSCALL_CANCEL1(name, a1) \ - __internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL2(name, a1, a2) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL3(name, a1, a2, a3) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, \ - 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, \ + 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL4(name, a1, a2, a3, a4) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), __SSC (a5), 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), __SSC (a5), 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC (a4), __SSC (a5), __SSC (a6), \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC (a4), __SSC (a5), __SSC (a6), \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC (a4), __SSC (a5), __SSC (a6), \ - __SSC (a7), __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC (a4), __SSC (a5), __SSC (a6), \ + __SSC (a7), __NR_##name) /* Issue a cancellable syscall defined by syscall number NAME plus any other argument required. If an error occurs its value is returned as an negative diff --git a/sysdeps/unix/sysv/linux/epoll_pwait2.c b/sysdeps/unix/sysv/linux/epoll_pwait2.c index 4da03e3e69..76ec1f8a71 100644 --- a/sysdeps/unix/sysv/linux/epoll_pwait2.c +++ b/sysdeps/unix/sysv/linux/epoll_pwait2.c @@ -17,7 +17,7 @@ . */ #include -#include +#include int __epoll_pwait2_time64 (int fd, struct epoll_event *ev, int maxev, diff --git a/sysdeps/unix/sysv/linux/recvmmsg.c b/sysdeps/unix/sysv/linux/recvmmsg.c index 6fbe4b80aa..6a89f914c2 100644 --- a/sysdeps/unix/sysv/linux/recvmmsg.c +++ b/sysdeps/unix/sysv/linux/recvmmsg.c @@ -16,7 +16,7 @@ . */ #include -#include +#include #include static int diff --git a/sysdeps/unix/sysv/linux/sigtimedwait.c b/sysdeps/unix/sysv/linux/sigtimedwait.c index a4fa8e9e8e..c2c5e2c0f2 100644 --- a/sysdeps/unix/sysv/linux/sigtimedwait.c +++ b/sysdeps/unix/sysv/linux/sigtimedwait.c @@ -16,7 +16,7 @@ . */ #include -#include +#include int __sigtimedwait64 (const sigset_t *set, siginfo_t *info, diff --git a/sysdeps/unix/sysv/linux/sysdep-cancel.h b/sysdeps/unix/sysv/linux/sysdep-cancel.h index 7fd8258ba5..4b7278915a 100644 --- a/sysdeps/unix/sysv/linux/sysdep-cancel.h +++ b/sysdeps/unix/sysv/linux/sysdep-cancel.h @@ -21,5 +21,66 @@ #define _SYSDEP_CANCEL_H #include +#include "pthreadP.h" + +/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and + returns the syscall value or its negative error code. */ +static __always_inline long int +internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, + __syscall_arg_t a3, __syscall_arg_t a4, + __syscall_arg_t a5, __syscall_arg_t a6, + __SYSCALL_CANCEL7_ARG_DEF + __syscall_arg_t nr) +{ + long int result; + struct pthread *pd = THREAD_SELF; + + /* If cancellation is not enabled, call the syscall directly and also + for thread terminatation to avoid call __syscall_do_cancel while + executing cleanup handlers. */ + int ch = atomic_load_relaxed (&pd->cancelhandling); + if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch)) + { + result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6 + __SYSCALL_CANCEL7_ARCH_ARG7); + if (INTERNAL_SYSCALL_ERROR_P (result)) + return -INTERNAL_SYSCALL_ERRNO (result); + return result; + } + + /* Call the arch-specific entry points that contains the globals markers + to be checked by SIGCANCEL handler. */ + result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5, + a6 __SYSCALL_CANCEL7_ARCH_ARG7); + + /* If the cancellable syscall was interrupted by SIGCANCEL and it has no + side-effect, cancel the thread if cancellation is enabled. */ + ch = atomic_load_relaxed (&pd->cancelhandling); + /* The behaviour here assumes that EINTR is returned only if there are no + visible side effects. POSIX Issue 7 has not yet provided any stronger + language for close, and in theory the close syscall could return EINTR + and leave the file descriptor open (conforming and leaks). It expects + that no such kernel is used with glibc. */ + if (result == -EINTR && cancel_enabled_and_canceled (ch)) + __syscall_do_cancel (); + + return result; +} + +/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the + syscall expected success value (usually 0) or, in case of failure, -1 and + sets errno to syscall return value. */ +static __always_inline long int +syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, + __syscall_arg_t a3, __syscall_arg_t a4, + __syscall_arg_t a5, __syscall_arg_t a6, + __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr) +{ + long int r = internal_syscall_cancel (a1, a2, a3, a4, a5, a6, + __SYSCALL_CANCEL7_ARG nr); + return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r)) + ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r)) + : r; +} #endif -- 2.55.0 From 5d1e923ed79185668ac62d19fc37e7e23a3642b6 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 6 Aug 2026 14:07:55 -0300 Subject: [PATCH 10/49] Fix gen-as-const-headers races with the parallel subdir recursion (BZ 34438) The parallel subdirectory recursion (commit 7cac99621e96) only orders csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges the Depend files request. A header generated from gen-as-const-headers is only ordered before the compilations of the subdirectory that adds the .sym (through before-compile), so a header consumed by a different subdirectory may not exist yet when its consumer is compiled. That is the case for : it is generated when building misc, while its only consumer, ____longjmp_chk.S (x86_64 and sh), is built in debug. The serial recursion always ran misc before debug in the sorted order, hiding the missing dependency. Move the generate the header to 'debug' instead. The same class of problem exists on Hurd: jmp_buf-ssp.h that is used by ____longjmp_chk.S in debug, and signal-defines.h that is sued by debug and setjmp. Deterministically reproduced with 'make debug/subdir_lib' from a clean build tree (which orders only csu before debug), and verified with builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu. Reviewed-by: Sam James (cherry picked from commit 60c9ed0e6b9cce07e85ee56fc39b9afe36919e45) --- Makerules | 12 +++++++++++- NEWS | 2 ++ sysdeps/mach/hurd/x86/Makefile | 6 +----- sysdeps/unix/sysv/linux/sh/Makefile | 4 +++- sysdeps/unix/sysv/linux/x86_64/Makefile | 4 +++- sysdeps/x86/Makefile | 10 ++++++++-- 6 files changed, 28 insertions(+), 10 deletions(-) diff --git a/Makerules b/Makerules index 6bef57ece9..cef30974f1 100644 --- a/Makerules +++ b/Makerules @@ -259,7 +259,17 @@ endif # gen-py-const-headers ifdef gen-as-const-headers # Generating headers for assembly constants. # We need this defined early to get into before-compile before -# it's used in sysd-rules, below. +# it's used in sysd-rules, below. The gen-as-const-headers is evaluated +# per subdirectory, so the before-compile dependency below only orders +# the generated header before the compiles of the subdirectory whose +# Makefile adds the .sym directive. +# The parallel subdirectory recursion does not order sibling subdirectories, +# so a .sym must be added in the subdirectory that compiles its consumers, +# or in csu (which runs before the parallel) when it has consumers in +# several subdirectories. +# It must not add the same .sym in several subdirectories though: their +# concurrent sub-makes would race generating the header through the fixed +# temporary files below. # Define GEN_AS_CONST_HEADERS to avoid circular dependency [BZ #22792]. # NB: is generated from tcb-offsets.sym to define # offsets and sizes of types in and maybe which diff --git a/NEWS b/NEWS index 28fbd9bcd8..ee292ff6c9 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,8 @@ The following bugs are resolved with this release: [34338] libc: Cancellable syscall wrappers are missing from backtraces because they tail-call __syscall_cancel + [34438] build: non reproducible build failure: sigaltstack-offsets.h: + No such file or directory [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong diff --git a/sysdeps/mach/hurd/x86/Makefile b/sysdeps/mach/hurd/x86/Makefile index 97e3287c87..1d94f3a1c1 100644 --- a/sysdeps/mach/hurd/x86/Makefile +++ b/sysdeps/mach/hurd/x86/Makefile @@ -3,11 +3,7 @@ sysdep_routines += ioperm sysdep_headers += sys/io.h endif -ifeq ($(subdir),debug) -gen-as-const-headers += signal-defines.sym -endif - -ifeq ($(subdir),setjmp) +ifeq ($(subdir),csu) gen-as-const-headers += signal-defines.sym endif diff --git a/sysdeps/unix/sysv/linux/sh/Makefile b/sysdeps/unix/sysv/linux/sh/Makefile index dd3b382ac1..8c4cb73824 100644 --- a/sysdeps/unix/sysv/linux/sh/Makefile +++ b/sysdeps/unix/sysv/linux/sh/Makefile @@ -6,7 +6,9 @@ ifeq ($(subdir),stdlib) gen-as-const-headers += ucontext_i.sym endif -ifeq ($(subdir),misc) +# is only used by ____longjmp_chk.S, which is +# built in the debug subdirectory. +ifeq ($(subdir),debug) gen-as-const-headers += sigaltstack-offsets.sym endif diff --git a/sysdeps/unix/sysv/linux/x86_64/Makefile b/sysdeps/unix/sysv/linux/x86_64/Makefile index 6938382801..528fd951b2 100644 --- a/sysdeps/unix/sysv/linux/x86_64/Makefile +++ b/sysdeps/unix/sysv/linux/x86_64/Makefile @@ -10,7 +10,9 @@ ifeq ($(subdir),csu) gen-as-const-headers += ucontext_i.sym endif -ifeq ($(subdir),misc) +# is only used by ____longjmp_chk.S, which is +# built in the debug subdirectory. +ifeq ($(subdir),debug) gen-as-const-headers += sigaltstack-offsets.sym endif diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 232e388d32..b4434deb0c 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -1,5 +1,12 @@ ifeq ($(subdir),csu) -gen-as-const-headers += cpu-features-offsets.sym features-offsets.sym +# is used by the setjmp/longjmp implementations in the +# setjmp subdirectory and also by ____longjmp_chk.S in the debug +# subdirectory. +gen-as-const-headers += \ + cpu-features-offsets.sym \ + features-offsets.sym \ + jmp_buf-ssp.sym \ + # gen-as-const-headers endif ifeq ($(subdir),elf) @@ -171,7 +178,6 @@ tests += \ endif # $(subdir) == math ifeq ($(subdir),setjmp) -gen-as-const-headers += jmp_buf-ssp.sym sysdep_routines += __longjmp_cancel endif -- 2.55.0 From 45b8a13c48da92bc5dd6fe102011391dd6847862 Mon Sep 17 00:00:00 2001 From: Rudi Heitbaum Date: Thu, 6 Aug 2026 14:07:56 -0300 Subject: [PATCH 11/49] Makerules: Only install the ABI lib-names header from the top level (BZ 34439) The $(inst_includedir)/%.h install rules exist only where $(headers) is non-empty, so in a subdir without headers (e.g. csu) the prerequisite added on install-others-nosubdir has no rule. It only worked because .NOTPARALLEL made the top level install the header first, which the parallel subdir recursion no longer guarantees. Reviewed-by: Sam James (cherry picked from commit 82c0a96b8e63005a49ba52ddb21993811030613f) --- Makerules | 5 +++++ NEWS | 2 ++ 2 files changed, 7 insertions(+) diff --git a/Makerules b/Makerules index cef30974f1..dfe66b7fa6 100644 --- a/Makerules +++ b/Makerules @@ -312,7 +312,12 @@ lib-names-h-abi = gnu/lib-names-$(default-abi).h lib-names-stmp-abi = gnu/lib-names-$(default-abi).stmp before-compile += $(common-objpfx)$(lib-names-h-abi) common-generated += gnu/lib-names.h +# The $(inst_includedir)/%.h install rules are defined only where $(headers) +# is non-empty, and with parallel subdir recursion a subdir without headers +# (e.g. csu) may run before the top level has installed the header. +ifndef subdir install-others-nosubdir: $(inst_includedir)/$(lib-names-h-abi) +endif $(common-objpfx)gnu/lib-names.h: $(make-target-directory) { \ diff --git a/NEWS b/NEWS index ee292ff6c9..d0ef2d3e9a 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ The following bugs are resolved with this release: because they tail-call __syscall_cancel [34438] build: non reproducible build failure: sigaltstack-offsets.h: No such file or directory + [34439] build: parallel make install fails on multi-ABI targets: no + rule to make $(inst_includedir)/gnu/lib-names-$(abi).h in csu [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong -- 2.55.0 From f7beb24f3ad5dbf8e84a5b75d5b2428a262e9ab9 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 6 Aug 2026 14:07:57 -0300 Subject: [PATCH 12/49] Makefile: Only print the test summary in the second pass of 'make check' The build-only first pass of the two-pass 'make check' still runs the static checks (abi, conformtest, installed headers, etc.), and the top-level tests recipe merged and summarized their results. An unexpected FAIL there (e.g. check-abi) aborted 'check' before the second pass ran any built test, and even a clean run printed a misleading partial summary. Pass tests-summary=no in the first pass to skip the merge and summary; the .test-result files persist, so the second pass folds those results into the one complete summary at the end, restoring the single-pass reporting behavior. Reviewed-by: Sam James (cherry picked from commit 96a9a09d7d5527462a823c247569e65feeca8ddb) --- Makefile | 7 +++++++ Makerules | 11 +++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index a6aabca691..b9fac6f47c 100644 --- a/Makefile +++ b/Makefile @@ -869,7 +869,11 @@ endif touch $(objpfx)testroot.pristine/install.stamp tests-special-notdir = $(patsubst $(objpfx)%, %, $(tests-special)) +# The build-only first pass of the two-pass 'make check' (see Makerules) +# passes tests-summary=no: the merge and summary are left to the second +# pass, which folds in this pass's $(tests-special) results. tests: $(tests-special) +ifneq ($(tests-summary),no) $(..)scripts/merge-test-results.sh -s $(objpfx) "" \ $(sort $(tests-special-notdir:.out=)) \ > $(objpfx)subdir-tests.sum @@ -877,11 +881,14 @@ tests: $(tests-special) $(sort $(subdirs) .) \ > $(objpfx)tests.sum $(call summarize-tests,tests.sum) +endif xtests: +ifneq ($(tests-summary),no) $(..)scripts/merge-test-results.sh -t $(objpfx) subdir-xtests.sum \ $(sort $(subdirs)) \ > $(objpfx)xtests.sum $(call summarize-tests,xtests.sum, for extra tests) +endif # The realclean target is just like distclean for the parent, but we want # the subdirs to know the difference in case they care. diff --git a/Makerules b/Makerules index dfe66b7fa6..5f65f3ab9e 100644 --- a/Makerules +++ b/Makerules @@ -1211,6 +1211,13 @@ ALL_BUILD_CFLAGS = $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) -D_GNU_SOURCE \ # therefore builds the test programs (run-built-tests=no, recursion fully # parallel) and then runs them (run-built-tests=yes). 'make tests' and a # subdirectory's own 'check' stay single-pass. +# The first pass still runs the static checks ($(tests-special): abi, +# conformtest, installed headers, ...), so tests-summary=no makes it skip +# the results merge and summary: an unexpected FAIL there would otherwise +# abort 'check' before the second pass runs any built test, and even a +# clean run would print a misleading partial summary. The .test-result +# files persist, so the second pass folds those results into the one +# complete summary at the end. check-twopass := ifndef subdir ifeq (yes,$(run-built-tests)) @@ -1219,10 +1226,10 @@ endif endif ifeq (yes,$(check-twopass)) check: - $(MAKE) run-built-tests=no tests + $(MAKE) run-built-tests=no tests-summary=no tests $(MAKE) run-built-tests=yes tests xcheck: - $(MAKE) run-built-tests=no xtests + $(MAKE) run-built-tests=no tests-summary=no xtests $(MAKE) run-built-tests=yes xtests else check: tests -- 2.55.0 From fc3641194619c7c327ef398c88c07b3069878ed3 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 6 Aug 2026 14:07:58 -0300 Subject: [PATCH 13/49] Makerules: Make the .dt to .d conversion safe against concurrent sub-makes The %.d: %.dt rule seds its input into a fixed temporary name, renames it into place and removes the input. Two makes converting the same file trip over each other: mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory That happens because the elf rtld-Rules recursion runs a sub-make over every $(rtld-subdirs) directory, which converts that directory's .dt files, and the parallel subdirectory recursion (commit 7cac99621e96) runs it concurrently with those subdirectories' own sub-makes. Add the PID of the shell to the temporary name and claim the input with a rename: only the run that wins converts and installs the target. Reviewed-by: Sam James (cherry picked from commit ba8c8801be7674cc12406914184516a811ac22a8) --- Makerules | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/Makerules b/Makerules index 5f65f3ab9e..be51154bae 100644 --- a/Makerules +++ b/Makerules @@ -758,10 +758,20 @@ all-dt-files := $(foreach o,$(object-suffixes-for-libc),$(+depfiles:.d=$o.dt)) $(wildcard $(all-dt-files:.dt=.d)) # This is a funny rule in that it removes its input file. +# +# More than one make can convert the .dt files of a single object +# directory: the elf rtld-Rules recursion runs a sub-make over every +# $(rtld-subdirs) directory, concurrently with that directory's own +# sub-make under the parallel subdir recursion. Add the PID of the +# shell to the temporary name and claim the input with a rename: only +# the run that wins converts and installs the target. %.d: %.dt - @sed $(sed-remove-objpfx) $< > $(@:.d=.T) && \ - mv -f $(@:.d=.T) $@ && \ - rm -f $< + @dt=$(@:.d=.T)$$$$; \ + if mv -f $< $$dt 2>/dev/null; then \ + sed $(sed-remove-objpfx) $$dt > $$dt.new && \ + mv -f $$dt.new $@ && \ + rm -f $$dt; \ + fi # Avoid the .h.d files for any .sym files whose .h files don't exist yet. # They will be generated when they're needed, and trying too early won't work. @@ -1433,7 +1443,7 @@ endef # Also remove the dependencies and generated source files. common-clean: common-mostlyclean -rm -f $(addprefix $(objpfx),$(generated)) - -rm -f $(objpfx)*.d $(objpfx)*.dt + -rm -f $(objpfx)*.d $(objpfx)*.dt $(objpfx)*.T[0-9]* -rm -fr $(addprefix $(objpfx),$(generated-dirs)) -rm -f $(addprefix $(common-objpfx),$(common-generated)) -rm -f $(gen-as-const-headers:%.sym=$(common-objpfx)%.h) -- 2.55.0 From f34027b27fefbc94aab04bff613ba5c24fb909b1 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 6 Aug 2026 14:07:59 -0300 Subject: [PATCH 14/49] Makefile: Order the top-level stamp files before the subdirectory fan-out The archive rules in Makerules list every stamp file as a prerequisite, including the top level's own, and the elf sub-make evaluates them to build libc_pic.a for the librtld.map link. A sub-make can only create the stamp files of its own directory, so when the top-level ones do not exist yet it fails with: make[2]: *** No rule to make target '.../stamp.os', needed by '.../libc_pic.a'. Stop. The serial recursion created them before the subdirectories through the prerequisite order of subdir_lib; the parallel recursion (commit 7cac99621e96) does not. Add them as prerequisites of the object-building per-subdirectory targets. Reviewed-by: Sam James (cherry picked from commit 25c42d04c45fc5fdb1481a7f968782791b21fd3e) --- Makefile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Makefile b/Makefile index b9fac6f47c..d559c42873 100644 --- a/Makefile +++ b/Makefile @@ -575,6 +575,14 @@ $(foreach t,$(+elf_last_subdir_targets),$(eval \ elf/$(t): $(addsuffix /$(t),$(filter-out elf,$(subdirs))))) endif +# The archive rules in Makerules list every stamp file as a +# prerequisite of libc_pic.a, which the elf sub-make evaluates for the +# librtld.map link, but a sub-make can only create its own directory's +# stamps. Create the top-level ones before the fan-out. +$(foreach t,$(+elf_last_subdir_targets),$(eval \ + $(addsuffix /$(t),$(subdirs)): \ + $(foreach o,$(object-suffixes-for-libc),$(common-objpfx)stamp$(o)))) + # Pass barriers: a subdirectory 'others' build links programs against # the libraries, so the 'lib' pass (including the top-level libc.so # link) must have completed. -- 2.55.0 From 10e3ce8a57e134c13dd28772de68542b0e3d4e86 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 6 Aug 2026 14:08:00 -0300 Subject: [PATCH 15/49] arm: Order the rtld link after libgcc-stubs.a The librtld.map and librtld.os link recipes use $(gnulib), which on arm contains libgcc-stubs.a through gnulib-arch. But the archive is only a prerequisite of lib-noranlib so the rtld link can run before the archive exists: ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory The race seems to predates the parallel subdirectory recursion, which only made it observable. Add the order-only dependency in sysdeps/arm/Makefile rather than in elf/Makefile. Theprerequisite lists expand when the rule is parsed, and gnulib-arch is only defined once Makerules includes the sysdeps makefiles. Verified with a build for arm-linux-gnueabihf. Reviewed-by: Sam James (cherry picked from commit a33ceb6e96dc8de8d36de1b1f3ec06ceb524d012) --- sysdeps/arm/Makefile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile index 0bb1b6e05b..9042315492 100644 --- a/sysdeps/arm/Makefile +++ b/sysdeps/arm/Makefile @@ -10,6 +10,11 @@ shared-only-routines += aeabi_unwind_cpp_pr1 $(objpfx)libgcc-stubs.a: $(objpfx)aeabi_unwind_cpp_pr1.os $(build-extra-lib) +# The rtld link recipes in elf/Makefile use $(gnulib), which here +# includes libgcc-stubs.a, but they cannot name it as a prerequisite: +# gnulib-arch is only defined once this file is included from Makerules. +$(objpfx)librtld.map $(objpfx)librtld.os: | $(objpfx)libgcc-stubs.a + lib-noranlib: $(objpfx)libgcc-stubs.a ifeq ($(build-shared),yes) -- 2.55.0 From 26b9cc42a051f78233fcecd2a3b83f98ec9862b9 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Tue, 28 Jul 2026 11:27:33 -0300 Subject: [PATCH 16/49] benchtests: Create objdir in the bench-%.c generation rule The $(objpfx)bench-%.c rule writes its output into $(objpfx) without ensuring that directory exists. Serial builds happened to satisfy that ordering, with parallel builds the generation recipe can run before the directory is created, failing with: cannot create .../benchtests/bench-xxx.c-tmp: Directory nonexistent Add the standard $(make-target-directory). Reviewed-by: Florian Weimer (cherry picked from commit 26f0f2aa7d6ea63f85b5186349c41de2c91b4dd7) --- benchtests/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/benchtests/Makefile b/benchtests/Makefile index f407e492cb..16cc951d19 100644 --- a/benchtests/Makefile +++ b/benchtests/Makefile @@ -622,6 +622,7 @@ $(bench-link-targets): %: %.o $(objpfx)json-lib.o \ $(bench-link-targets): LDFLAGS += $(link-bench-bind-now) $(objpfx)bench-%.c: %-inputs $(bench-deps) + $(make-target-directory) { if [ -n "$($*-INCLUDE)" ]; then \ cat $($*-INCLUDE); \ fi; \ -- 2.55.0 From 4662c4675d7f3ba87637c61730f06071f305c5cb Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Sun, 26 Jul 2026 00:11:44 +0800 Subject: [PATCH 17/49] elf: test: handle different rootsbindir in tst-ldconfig-cache When compiling a glibc for a merged-/usr distro people may set rootsbindir=/usr/sbin. But tst-ldconfig-cache has hard-coded /sbin/ldconfig path and so it fails with a different rootsbindir. Fix it by using support_install_rootsbindir like run_ldconfig in test-container.c. Signed-off-by: Xi Ruoyao Reviewed-by: Florian Weimer (cherry picked from commit 02ea17b5add83a205d8b204dce28f38fe0498ea3) --- elf/tst-ldconfig-cache.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/elf/tst-ldconfig-cache.c b/elf/tst-ldconfig-cache.c index 9f71418b3a..f4820a1822 100644 --- a/elf/tst-ldconfig-cache.c +++ b/elf/tst-ldconfig-cache.c @@ -85,7 +85,10 @@ corrupt (void) static void ldconfig (void) { - xsystem ("/sbin/ldconfig -X"); + char *cmd = xasprintf("%s/ldconfig -X", support_install_rootsbindir); + xsystem (cmd); + + free(cmd); } /* Change ld.so.conf to refer to the new directory, and generate a new -- 2.55.0 From 9e1b1ef77c7b1cc58f625500e9ea74fb3cafdf12 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Sun, 26 Jul 2026 00:27:37 -0400 Subject: [PATCH 18/49] ldbl-opt: Fix -mlong-double-128 configure test for Clang The check for -mlong-double-128 support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail (and thus the whole build error out) with Clang even though it supports -mlong-double-128. Use AC_LANG_SOURCE so the function is defined at file scope, matching the pattern already used by the powerpc64le compiler checks, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit e7a14f03b8d5e34e8ac46db6c377da5c66a3ec2a) --- sysdeps/ieee754/ldbl-opt/configure | 7 ------- sysdeps/ieee754/ldbl-opt/configure.ac | 2 +- 2 files changed, 1 insertion(+), 8 deletions(-) mode change 100644 => 100755 sysdeps/ieee754/ldbl-opt/configure diff --git a/sysdeps/ieee754/ldbl-opt/configure b/sysdeps/ieee754/ldbl-opt/configure old mode 100644 new mode 100755 index bc6552da0b..7769cc9781 --- a/sysdeps/ieee754/ldbl-opt/configure +++ b/sysdeps/ieee754/ldbl-opt/configure @@ -13,17 +13,10 @@ CFLAGS="$CFLAGS -mlong-double-128" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -int -main (void) -{ - #ifndef __LONG_DOUBLE_128__ # error "compiler did not predefine __LONG_DOUBLE_128__ as expected" #endif long double foobar (long double x) { return x; } - ; - return 0; -} _ACEOF if ac_fn_c_try_compile "$LINENO" then : diff --git a/sysdeps/ieee754/ldbl-opt/configure.ac b/sysdeps/ieee754/ldbl-opt/configure.ac index 70e3b32dc6..1c500ad581 100644 --- a/sysdeps/ieee754/ldbl-opt/configure.ac +++ b/sysdeps/ieee754/ldbl-opt/configure.ac @@ -6,7 +6,7 @@ AC_CACHE_CHECK(whether $CC $CFLAGS supports -mlong-double-128, libc_cv_mlong_double_128, [dnl save_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -mlong-double-128" -AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[ +AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ #ifndef __LONG_DOUBLE_128__ # error "compiler did not predefine __LONG_DOUBLE_128__ as expected" #endif -- 2.55.0 From eacd9cced93498e671c7e7f758aaf52593847e01 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Sun, 26 Jul 2026 14:43:11 -0400 Subject: [PATCH 19/49] powerpc: Fix -mlong-double-128 IBM format configure test for Clang The check for -mlong-double-128 IBM extended format support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail with Clang. Use AC_LANG_SOURCE so the function is defined at file scope, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit 559d0f77f3ee1000cf8a2d0baba7a59a1ec45f50) --- sysdeps/unix/sysv/linux/powerpc/configure | 8 +------- sysdeps/unix/sysv/linux/powerpc/configure.ac | 3 ++- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/sysdeps/unix/sysv/linux/powerpc/configure b/sysdeps/unix/sysv/linux/powerpc/configure index ef2055db92..eb8578404f 100644 --- a/sysdeps/unix/sysv/linux/powerpc/configure +++ b/sysdeps/unix/sysv/linux/powerpc/configure @@ -12,18 +12,12 @@ else case e in #( CFLAGS="$CFLAGS -mlong-double-128" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -#include -int -main (void) -{ +#include #if LDBL_MANT_DIG != 106 # error "compiler doesn't implement IBM extended format of long double" #endif long double foobar (long double x) { return x; } - ; - return 0; -} _ACEOF if ac_fn_c_try_compile "$LINENO" then : diff --git a/sysdeps/unix/sysv/linux/powerpc/configure.ac b/sysdeps/unix/sysv/linux/powerpc/configure.ac index 42347a66fc..ca0f82da08 100644 --- a/sysdeps/unix/sysv/linux/powerpc/configure.ac +++ b/sysdeps/unix/sysv/linux/powerpc/configure.ac @@ -6,7 +6,8 @@ AC_CACHE_CHECK(whether $CC $CFLAGS -mlong-double-128 uses IBM extended format, libc_cv_mlong_double_128ibm, [dnl save_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -mlong-double-128" -AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ +AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ +#include #if LDBL_MANT_DIG != 106 # error "compiler doesn't implement IBM extended format of long double" #endif -- 2.55.0 From 89da37bb6e4a631f375b5fe48783e5c023441b0c Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Tue, 4 Aug 2026 10:17:20 -0400 Subject: [PATCH 20/49] stdio-common: run AWK in the C locale in the printf format tests The program under test runs in the C locale, through the test program prefix, but AWK inherits whatever locale the build was started in. They agree today only because the locale in use shares its decimal point with the C locale. It is also faster. gawk takes a single byte path in its regular expression engine when MB_CUR_MAX is 1, and the script matches several expressions against every line. For the %f conversion for double, the largest of these tests, as the median of five runs: x86_64, gawk 5.4.1 1.482s -> 1.248s x86_64, gawk 5.3.2 0.911s -> 0.703s alpha, gawk 5.4.60 30.9s -> 26.6s Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at 1.248s against 0.703s for the same input in the C locale, so these tests have become more expensive than they used to be. Reviewed-by: Adhemerval Zanella (cherry picked from commit 866a70167b85903a02d4ccacb91afb8922702c14) --- stdio-common/tst-printf-format-c.sh | 2 +- stdio-common/tst-printf-format-char.sh | 2 +- stdio-common/tst-printf-format-double.sh | 2 +- stdio-common/tst-printf-format-int.sh | 2 +- stdio-common/tst-printf-format-ldouble.sh | 2 +- stdio-common/tst-printf-format-llong.sh | 2 +- stdio-common/tst-printf-format-long.sh | 2 +- stdio-common/tst-printf-format-s.sh | 2 +- stdio-common/tst-printf-format-short.sh | 2 +- stdio-common/tst-printf-format-uchar.sh | 2 +- stdio-common/tst-printf-format-uint.sh | 2 +- stdio-common/tst-printf-format-ullong.sh | 2 +- stdio-common/tst-printf-format-ulong.sh | 2 +- stdio-common/tst-printf-format-ushort.sh | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) diff --git a/stdio-common/tst-printf-format-c.sh b/stdio-common/tst-printf-format-c.sh index 825c50ec42..73d28c5607 100644 --- a/stdio-common/tst-printf-format-c.sh +++ b/stdio-common/tst-printf-format-c.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" echo Verifying c (set -o pipefail diff --git a/stdio-common/tst-printf-format-char.sh b/stdio-common/tst-printf-format-char.sh index 7867bdd62f..aa4d211126 100644 --- a/stdio-common/tst-printf-format-char.sh +++ b/stdio-common/tst-printf-format-char.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-double.sh b/stdio-common/tst-printf-format-double.sh index 8157092dc4..051e4716c5 100644 --- a/stdio-common/tst-printf-format-double.sh +++ b/stdio-common/tst-printf-format-double.sh @@ -29,7 +29,7 @@ test_program_prefix=$1; shift # internally to process the conversion requested, so any bug in our code # would then be verified against itself, defeating the objective of doing # the verification against an independent implementation. -AWK="${AWK:-awk} -M" +AWK="env LC_ALL=C ${AWK:-awk} -M" status=77 diff --git a/stdio-common/tst-printf-format-int.sh b/stdio-common/tst-printf-format-int.sh index 8542ff4150..e9dcbedc04 100644 --- a/stdio-common/tst-printf-format-int.sh +++ b/stdio-common/tst-printf-format-int.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ldouble.sh b/stdio-common/tst-printf-format-ldouble.sh index dbf78a98c6..7ee097ac0a 100644 --- a/stdio-common/tst-printf-format-ldouble.sh +++ b/stdio-common/tst-printf-format-ldouble.sh @@ -29,7 +29,7 @@ test_program_prefix=$1; shift # internally to process the conversion requested, so any bug in our code # would then be verified against itself, defeating the objective of doing # the verification against an independent implementation. -AWK="${AWK:-awk} -M" +AWK="env LC_ALL=C ${AWK:-awk} -M" status=77 diff --git a/stdio-common/tst-printf-format-llong.sh b/stdio-common/tst-printf-format-llong.sh index e1f5252c9a..98a79660cc 100644 --- a/stdio-common/tst-printf-format-llong.sh +++ b/stdio-common/tst-printf-format-llong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-long.sh b/stdio-common/tst-printf-format-long.sh index 4b68ab1e04..89ac3302b8 100644 --- a/stdio-common/tst-printf-format-long.sh +++ b/stdio-common/tst-printf-format-long.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-s.sh b/stdio-common/tst-printf-format-s.sh index 65aa0cb675..015c730609 100644 --- a/stdio-common/tst-printf-format-s.sh +++ b/stdio-common/tst-printf-format-s.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" echo Verifying s (set -o pipefail diff --git a/stdio-common/tst-printf-format-short.sh b/stdio-common/tst-printf-format-short.sh index 30357baa02..a7df8b8e6d 100644 --- a/stdio-common/tst-printf-format-short.sh +++ b/stdio-common/tst-printf-format-short.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-uchar.sh b/stdio-common/tst-printf-format-uchar.sh index 08a6914b88..356de4217d 100644 --- a/stdio-common/tst-printf-format-uchar.sh +++ b/stdio-common/tst-printf-format-uchar.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-uint.sh b/stdio-common/tst-printf-format-uint.sh index 0ba203ccda..b496047a49 100644 --- a/stdio-common/tst-printf-format-uint.sh +++ b/stdio-common/tst-printf-format-uint.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ullong.sh b/stdio-common/tst-printf-format-ullong.sh index 5b881ab924..f030f66a24 100644 --- a/stdio-common/tst-printf-format-ullong.sh +++ b/stdio-common/tst-printf-format-ullong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ulong.sh b/stdio-common/tst-printf-format-ulong.sh index f6aeb8e3c0..7102575ed2 100644 --- a/stdio-common/tst-printf-format-ulong.sh +++ b/stdio-common/tst-printf-format-ulong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ushort.sh b/stdio-common/tst-printf-format-ushort.sh index 07609128ab..5f612b5398 100644 --- a/stdio-common/tst-printf-format-ushort.sh +++ b/stdio-common/tst-printf-format-ushort.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 -- 2.55.0 From 7cc7a3a4fbf15c8a7d61a69452f754f9c352cd62 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Mon, 3 Aug 2026 21:59:44 -0400 Subject: [PATCH 21/49] stdio-common: avoid repeated regexp matches in tst-printf-format.awk Whether the value is an infinity, a NaN or zero does not change between the conversions applied to it, but was determined again for each one. Determine it where the value is read. Also look for the '#' flag with index() before matching the expressions that need it, and test the value first where both have to hold. For the %f conversion for double, in the C locale, as the median of five runs: x86_64, gawk 5.4.1 1.248s -> 1.184s x86_64, gawk 5.3.2 0.703s -> 0.708s alpha, gawk 5.4.60 26.6s -> 25.8s So this only helps with the regular expression engine that gawk 5.4 brought in; under 5.3.2 it is lost in the noise. Output and exit status are unchanged for the e, f and g conversions for double under both gawk versions and both locales. Reviewed-by: Adhemerval Zanella (cherry picked from commit 0cc3f9b3f3f2950844bd41cc8923215cd5d97269) --- stdio-common/tst-printf-format.awk | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/stdio-common/tst-printf-format.awk b/stdio-common/tst-printf-format.awk index 5d0324c551..57bea12621 100644 --- a/stdio-common/tst-printf-format.awk +++ b/stdio-common/tst-printf-format.awk @@ -32,6 +32,9 @@ BEGIN { # non-bignum mode unless a sign has been explicitly given. Keep # original 'val' for reporting. value = gensub(/^(INF|NAN|inf|nan)/, "+\\1", 1, val) + # Neither changes between the conversions applied to this value. + value_infnan = value ~ /(INF|NAN|inf|nan)/ + value_zero = value == 0 next } @@ -52,7 +55,7 @@ BEGIN { # Discard the '#' flag with the octal conversion if output starts with # 0 in the absence of this flag. In that case no extra 0 is supposed # to be produced, but gawk prepends it anyway. - if (format ~ /#.*o/) + if (index(format, "#") && format ~ /#.*o/) { tmpfmt = gensub(/#/, "", "g", format) tmpout = sprintf(tmpfmt, value) @@ -62,7 +65,7 @@ BEGIN { # Likewise with the hexadecimal conversion where zero value with the # precision of zero is supposed to produce no characters, but gawk # outputs 0 instead. - else if (format ~ /#.*[Xx]/) + else if (index(format, "#") && format ~ /#.*[Xx]/) { tmpfmt = gensub(/#/, "", "g", format) tmpout = sprintf(tmpfmt, value) @@ -78,7 +81,7 @@ BEGIN { # values and reprint the output produced using the string conversion, # with the field width carried over and the relevant flags handled by # hand. - if (format ~ /[EFGefg]/ && value ~ /(INF|NAN|inf|nan)/) + if (value_infnan && format ~ /[EFGefg]/) { minus = format ~ /-/ ? "-" : "" sign = value ~ /-/ ? "-" : format ~ /\+/ ? "+" : format ~ / / ? " " : "" @@ -94,7 +97,7 @@ BEGIN { # In that case "+" is always supposed to be produced, but with the # precision of zero gawk in the non-bignum mode produces any padding # requested only. - else if (format ~ /\+.*[di]/ && value == 0) + else if (value_zero && format ~ /\+.*[di]/) { output = gensub(/^( *) $/, format ~ /-/ ? "+\\1" : "\\1+", 1, output) output = gensub(/^$/, "+", 1, output) @@ -103,7 +106,7 @@ BEGIN { # conversion for zero value. In that case at least one " " is # supposed to be produced, but with the precision of zero gawk in the # non-bignum mode produces nothing. - else if (format ~ / .*[di]/ && value == 0) + else if (value_zero && format ~ / .*[di]/) { output = gensub(/^$/, " ", 1, output) } -- 2.55.0 From 65d35639a9d055e423345c8748908c8aa48b19b9 Mon Sep 17 00:00:00 2001 From: Magnus Lindholm Date: Wed, 5 Aug 2026 23:14:58 +0200 Subject: [PATCH 22/49] string: Speed up strcmp test data initialization The strcmp and strncmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and two individual stores for every element. Generate at most max_char elements using an additive recurrence. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand this initial pattern using bulk copies, and then copy the completed first buffer to the second buffer. This preserves the generated test data while substantially reducing the initialization cost on slower systems. The change also applies to the wcscmp and wcsncmp tests, which include the same test sources. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit 9b323b95567dff46b34157ac4455734633921abb) --- string/test-strcmp.c | 28 ++++++++++++++++++++++++++-- string/test-strncmp.c | 28 ++++++++++++++++++++++++++-- 2 files changed, 52 insertions(+), 4 deletions(-) diff --git a/string/test-strcmp.c b/string/test-strcmp.c index 76ccff46e2..ca52827b11 100644 --- a/string/test-strcmp.c +++ b/string/test-strcmp.c @@ -156,6 +156,10 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t pattern_len; + size_t step + = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char; CHAR *s1, *s2; @@ -179,8 +183,28 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, i = align2 + CHARBYTES * (len + 2); s2 = (CHAR *)(buf2 + ((page_size - i) / 16 * 16) + align2); - for (i = 0; i < len; i++) - s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char; + /* The generated sequence repeats after at most max_char elements. */ + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) + { + s1[i] = 1 + value; + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + MEMCPY (s1 + i, s1, copy); + i += copy; + } + + MEMCPY (s2, s1, len); s1[len] = s2[len] = 0; s1[len + 1] = 23; diff --git a/string/test-strncmp.c b/string/test-strncmp.c index 54ada39eb2..9da0f21f60 100644 --- a/string/test-strncmp.c +++ b/string/test-strncmp.c @@ -190,6 +190,9 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds, { size_t i, buf_bound; CHAR *s1, *s2, *s1_end, *s2_end; + size_t value = 0; + size_t pattern_len; + size_t step = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char; align1 &= ~(CHARBYTES - 1); align2 &= ~(CHARBYTES - 1); @@ -216,8 +219,29 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds, s2[n] = 23; } - for (i = 0; i < buf_bound; i++) - s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char; + /* The generated sequence repeats after at most max_char elements. */ + pattern_len + = buf_bound < (size_t) max_char + ? buf_bound : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) + { + s1[i] = 1 + value; + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < buf_bound) + { + size_t copy = i < buf_bound - i ? i : buf_bound - i; + + MEMCPY (s1 + i, s1, copy); + i += copy; + } + + MEMCPY (s2, s1, buf_bound); s1[len] = 0; s2[len] = 0; -- 2.55.0 From 11ac3d78fc5e4f7f2846002e099f773ad8ff82fc Mon Sep 17 00:00:00 2001 From: Magnus Lindholm Date: Wed, 5 Aug 2026 23:14:59 +0200 Subject: [PATCH 23/49] string: Speed up strcasecmp test data initialization The strcasecmp and strncasecmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and call toupper and tolower for every element. Generate at most max_char elements using an additive recurrence and apply the case conversions while creating this initial pattern. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand the completed pattern using bulk copies. This preserves the generated test data and locale-dependent case conversion while substantially reducing the initialization cost on slower systems. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit c1fb5d0e6b8d292ac526974d05c5adb4c3827fb0) --- string/test-strcasecmp.c | 22 ++++++++++++++++++++-- string/test-strncasecmp.c | 23 +++++++++++++++++++++-- 2 files changed, 41 insertions(+), 4 deletions(-) diff --git a/string/test-strcasecmp.c b/string/test-strcasecmp.c index a5235fa1bb..d090dcbf36 100644 --- a/string/test-strcasecmp.c +++ b/string/test-strcasecmp.c @@ -63,6 +63,9 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t step = 23U % (size_t) max_char; + size_t pattern_len; char *s1, *s2; if (len == 0) @@ -80,10 +83,25 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, s1 = (char *) (buf1 + align1); s2 = (char *) (buf2 + align2); - for (i = 0; i < len; i++) + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) { - s1[i] = toupper (1 + 23 * i % max_char); + s1[i] = toupper (1 + value); s2[i] = tolower (s1[i]); + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + memcpy (s1 + i, s1, copy); + memcpy (s2 + i, s2, copy); + i += copy; } s1[len] = s2[len] = 0; diff --git a/string/test-strncasecmp.c b/string/test-strncasecmp.c index 035c680532..6b00113e66 100644 --- a/string/test-strncasecmp.c +++ b/string/test-strncasecmp.c @@ -83,6 +83,9 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t step = 23U % (size_t) max_char; + size_t pattern_len; char *s1, *s2; if (len == 0) @@ -100,10 +103,26 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char, s1 = (char *) (buf1 + align1); s2 = (char *) (buf2 + align2); - for (i = 0; i < len; i++) + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) { - s1[i] = toupper (1 + 23 * i % max_char); + s1[i] = toupper (1 + value); s2[i] = tolower (s1[i]); + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + memcpy (s1 + i, s1, copy); + memcpy (s2 + i, s2, copy); + i += copy; } s1[len] = s2[len] = 0; -- 2.55.0 From 16be1518495f1fa05481b0182c4e4c24927c62df Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 3 Aug 2026 11:02:53 -0300 Subject: [PATCH 24/49] elf: Honour skip_ifunc for cross-object IFUNC relocations [BZ #34428] Commit 63b31c05a8a ("elf: Defer all IRELATIVE relocations until after PLT setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation that may run an IFUNC resolver. That only holds for IFUNC symbols defined in the object being relocated: a reference to an IFUNC in another object is an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC nature is only known after symbol resolution inside elf_machine_rel. Those relocations stay in the regular pass, which no longer propagated skip_ifunc, so __RTLD_NOIFUNC was ignored for them. ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so the resolver was called and the diagnostic emitted: $ ldd -u /bin/ls /bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk' ldd -r with LD_BIND_NOW is affected in the same way. Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC. This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading (it reads as "do not process IFUNC", yet it takes a skip_ifunc argument). Replace it to: DL_RELOC_BOTH -> DL_RELOC_ALL DL_RELOC_NOIFUNC -> DL_RELOC_NORMAL DL_RELOC_IFUNC -> DL_RELOC_IRELATIVE ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three near-identical variants each. Checked on x86_64-linux-gnu, and built for all supported architectures. Reviewed-by: Sam James (cherry picked from commit 2f2e9bae4093e1c3ba61250e340d3c3b99788f68) --- elf/Makefile | 28 ++++++++ elf/dl-reloc-static-pie.c | 4 +- elf/dl-reloc.c | 6 +- elf/do-rel.h | 24 ++++--- elf/dynamic-link.h | 109 +++++++++++++----------------- elf/tst-ifunc-fault-dep-bindnow.c | 19 ++++++ elf/tst-ifunc-fault-dep-lazy.c | 27 ++++++++ elf/tst-ifunc-fault-mod.c | 38 +++++++++++ 8 files changed, 182 insertions(+), 73 deletions(-) create mode 100644 elf/tst-ifunc-fault-dep-bindnow.c create mode 100644 elf/tst-ifunc-fault-dep-lazy.c create mode 100644 elf/tst-ifunc-fault-mod.c diff --git a/elf/Makefile b/elf/Makefile index 8b063e1bba..d279a5135c 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -1396,6 +1396,13 @@ modules-names += \ tst-ifunc-tls-write-lib \ tst-tls-tdata-reloc-lib \ # modules-names +ifeq (yes,$(have-gcc-ifunc)) +tests += \ + tst-ifunc-fault-dep-bindnow \ + tst-ifunc-fault-dep-lazy \ + # tests +modules-names += tst-ifunc-fault-mod +endif ifneq (no,$(have-test-mtls-descriptor)) tests += tst-ifunc-tls-init-tlsdesc modules-names += tst-ifunc-tls-init-tlsdesc-lib @@ -2547,6 +2554,27 @@ $(objpfx)tst-ifunc-fault-bindnow.out: $(objpfx)tst-ifunc-fault-bindnow \ $(objpfx)ld.so $(tst-ifunc-fault-script) +LDFLAGS-tst-ifunc-fault-dep-lazy = -Wl,-z,lazy +LDFLAGS-tst-ifunc-fault-dep-bindnow = -Wl,-z,now +define tst-ifunc-fault-dep-script +( $(test-wrapper) $(rtld-prefix) --verify $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 $(rtld-prefix) $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_DEBUG=unused \ + $(rtld-prefix) $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_WARN=yes LD_BIND_NOW=1 \ + $(rtld-prefix) $< \ +) > $@; $(evaluate-test) +endef +$(objpfx)tst-ifunc-fault-dep-lazy: $(objpfx)tst-ifunc-fault-mod.so +$(objpfx)tst-ifunc-fault-dep-bindnow: $(objpfx)tst-ifunc-fault-mod.so +$(objpfx)tst-ifunc-fault-dep-lazy.out: $(objpfx)tst-ifunc-fault-dep-lazy \ + $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so + $(tst-ifunc-fault-dep-script) +$(objpfx)tst-ifunc-fault-dep-bindnow.out: \ + $(objpfx)tst-ifunc-fault-dep-bindnow \ + $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so + $(tst-ifunc-fault-dep-script) + LDFLAGS-tst-ifunc-plt-lib.so = -Wl,-z,lazy tst-ifunc-plt-bindnow-ENV = LD_BIND_NOW=1 diff --git a/elf/dl-reloc-static-pie.c b/elf/dl-reloc-static-pie.c index 8463e46147..5dc5a545a8 100644 --- a/elf/dl-reloc-static-pie.c +++ b/elf/dl-reloc-static-pie.c @@ -80,7 +80,7 @@ _dl_relocate_static_pie (void) /* Relocate ourselves so we can do normal function calls and data access using the global offset table. IRELATIVE entries are deferred. */ - ELF_DYNAMIC_RELOCATE_NOIFUNC (main_map, NULL, 0, 0); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, main_map, NULL, 0, 0, 0); /* Initialize _r_debug_extended. */ struct r_debug *r = _dl_debug_initialize (0, LM_ID_BASE); @@ -98,7 +98,7 @@ void _dl_relocate_static_pie_ifunc (void) { struct link_map *main_map = _dl_get_dl_main_map (); - ELF_DYNAMIC_RELOCATE_IFUNC (main_map, NULL, 0, 0); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, main_map, NULL, 0, 0, 0); main_map->l_relocated = 1; } #endif diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c index 15a6a4cffe..fa2f41ac44 100644 --- a/elf/dl-reloc.c +++ b/elf/dl-reloc.c @@ -278,7 +278,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[], IFUNC resolvers. Without this, a resolver would see the unrelocated initialiser bytes that were placed into the slot by the early _dl_allocate_tls_init. */ - ELF_DYNAMIC_RELOCATE_NOIFUNC (l, scope, lazy, consider_profiling); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, l, scope, lazy, + consider_profiling, skip_ifunc); #ifdef SHARED /* Re-initialise the static TLS slot with the .tdata so the IRELATIVE @@ -291,7 +292,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[], _dl_init_static_tls (l); #endif - ELF_DYNAMIC_RELOCATE_IFUNC (l, scope, lazy, skip_ifunc); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, l, scope, lazy, + 0, skip_ifunc); if ((consider_profiling || consider_symbind) && l->l_info[DT_PLTRELSZ] != NULL) diff --git a/elf/do-rel.h b/elf/do-rel.h index 7702244734..c610d12dbe 100644 --- a/elf/do-rel.h +++ b/elf/do-rel.h @@ -79,17 +79,23 @@ elf_dynamic_Rel_audit_symbind (struct link_map *map, /* Perform the relocations in MAP on the running program image as specified by RELTAG, SZTAG. If LAZY is nonzero, this is the first pass on PLT relocations; they should be set up to call _dl_runtime_resolve, rather - than fully resolved now. + than fully resolved now. If SKIP_IFUNC is nonzero no IFUNC resolver is + called; this is required for the trace modes (ldd -u / ldd -r), which + relocate objects. - IRELATIVE entries are always skipped (non-bootstrap); they are handled + IRELATIVE entries and relocations against an STT_GNU_IFUNC symbol defined + in MAP itself are always skipped (non-bootstrap); they are handled separately by elf_dynamic_do_Rel_irelative after all other relocations - for both .rel.dyn and .rel.plt have been processed. */ + for both .rel.dyn and .rel.plt have been processed. Relocations against + an IFUNC symbol defined in *another* object are not deferred, since the + IFUNC symbol is only known after symbol resolution, and the defining object + has already been relocated at this point. */ static inline void __attribute__ ((always_inline)) elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], ElfW(Addr) reladdr, ElfW(Addr) relsize, __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative, - int lazy) + int lazy, int skip_ifunc) { const ElfW(Rel) *relative = (const void *) reladdr; const ElfW(Rel) *r = relative + nrelative; @@ -111,7 +117,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], void *const r_addr_arg = (void *) (l_addr + r->r_offset); const struct r_found_version *rversion = &map->l_versions[ndx]; - elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, skip_ifunc); } #else /* !RTLD_BOOTSTRAP */ #if !defined DO_RELA || !defined ELF_MACHINE_PLT_REL @@ -126,7 +132,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], const ElfW (Sym) *sym = &symtab[ELFW (R_SYM) (r->r_info)]; if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_lazy_rel (map, scope, l_addr, r, 0); + elf_machine_lazy_rel (map, scope, l_addr, r, skip_ifunc); } } else @@ -158,7 +164,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, + skip_ifunc); elf_dynamic_Rel_audit_symbind (map, scope, r, sym, rversion, r_addr_arg); } @@ -172,7 +179,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg, + skip_ifunc); elf_dynamic_Rel_audit_symbind (map, scope, r, sym, NULL, r_addr_arg); } diff --git a/elf/dynamic-link.h b/elf/dynamic-link.h index 35141acec4..0130c63feb 100644 --- a/elf/dynamic-link.h +++ b/elf/dynamic-link.h @@ -78,18 +78,23 @@ elf_machine_lazy_rel (struct link_map *map, struct r_scope_elem *scope[], consumes precisely the very end of the DT_REL*, or DT_JMPREL and DT_REL* are completely separate and there is a gap between them. */ -/* This controls which sub-passes _ELF_DYNAMIC_DO_RELOC runs. Used to - interleave TLS / stack-protector setup between the two passes so IFUNC - resolvers see a fully-initialised TCB. */ -enum elf_dynamic_reloc_phase +/* Selects which relocations a pass processes. Splitting them allows the + caller to interleave TLS / stack-protector setup between the two passes, + so IFUNC resolvers see a fully-initialised TCB. + + This is orthogonal to the skip_ifunc argument, which says whether an IFUNC + resolver may be run at all and is honoured by every pass. In particular + DL_RELOC_NORMAL also runs IFUNC resolvers, for relocations against an + IFUNC symbol defined in another object. */ +enum elf_dynamic_reloc_pass { - DL_RELOC_BOTH = 0, /* Non-IRELATIVE pass then IRELATIVE pass. */ - DL_RELOC_NOIFUNC = 1, /* Non-IRELATIVE pass only. */ - DL_RELOC_IFUNC = 2, /* IRELATIVE pass only. */ + DL_RELOC_ALL = 0, /* Non-IRELATIVE relocations, then IRELATIVE. */ + DL_RELOC_NORMAL = 1, /* Non-IRELATIVE relocations only. */ + DL_RELOC_IRELATIVE = 2, /* IRELATIVE relocations only. */ }; # define _ELF_DYNAMIC_DO_RELOC(RELOC, reloc, map, scope, do_lazy, skip_ifunc, \ - test_rel, phase) \ + test_rel, pass) \ do { \ struct { ElfW(Addr) start, size; \ __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative; int lazy; } \ @@ -136,14 +141,15 @@ enum elf_dynamic_reloc_phase by the linker. */ \ if (!DO_RTLD_BOOTSTRAP) \ { \ - if ((phase) != DL_RELOC_IFUNC) \ + if ((pass) != DL_RELOC_IRELATIVE) \ for (int ranges_index = 0; ranges_index < 2; ++ranges_index) \ elf_dynamic_do_##reloc ((map), scope, \ ranges[ranges_index].start, \ ranges[ranges_index].size, \ ranges[ranges_index].nrelative, \ - ranges[ranges_index].lazy); \ - if ((phase) != DL_RELOC_NOIFUNC) \ + ranges[ranges_index].lazy, \ + skip_ifunc); \ + if ((pass) != DL_RELOC_NORMAL) \ for (int ranges_index = 0; ranges_index < 2; ++ranges_index) \ elf_dynamic_do_##reloc##_irelative ((map), scope, \ ranges[ranges_index].start, \ @@ -158,7 +164,8 @@ enum elf_dynamic_reloc_phase ranges[ranges_index].start, \ ranges[ranges_index].size, \ ranges[ranges_index].nrelative, \ - ranges[ranges_index].lazy); \ + ranges[ranges_index].lazy, \ + skip_ifunc); \ } while (0) # if ELF_MACHINE_NO_REL || ELF_MACHINE_NO_RELA @@ -169,37 +176,21 @@ enum elf_dynamic_reloc_phase # if ! ELF_MACHINE_NO_REL # include "do-rel.h" -# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc) \ - _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_BOTH) -# define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy) \ - _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, 0, \ - _ELF_CHECK_REL, DL_RELOC_NOIFUNC) -# define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc) \ +# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass) \ _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_IFUNC) + _ELF_CHECK_REL, pass) # else -# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing. */ +# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass) /* Nothing. */ # endif # if ! ELF_MACHINE_NO_RELA # define DO_RELA # include "do-rel.h" -# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc) \ - _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_BOTH) -# define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy) \ - _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, 0, \ - _ELF_CHECK_REL, DL_RELOC_NOIFUNC) -# define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) \ +# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass) \ _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_IFUNC) + _ELF_CHECK_REL, pass) # else -# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing. */ +# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass) /* Nothing. */ # endif # define ELF_DYNAMIC_DO_RELR(map) \ @@ -240,37 +231,33 @@ enum elf_dynamic_reloc_phase # else # define DO_RTLD_BOOTSTRAP 0 # endif -# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \ - do { \ - int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ - (consider_profile)); \ - if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ - ELF_DYNAMIC_DO_RELR (map); \ - ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc); \ - ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc); \ - ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy)); \ - } while (0) +/* Perform one relocation pass over MAP. PASS selects which relocations are + processed. It is orthogonal to SKIP_IFUNC, which suppresses running IFUNC + resolvers in whichever pass is selected. -/* Like ELF_DYNAMIC_RELOCATE but only processes the non-IRELATIVE pass. - The IRELATIVE pass must be completed later via ELF_DYNAMIC_RELOCATE_IFUNC. - Used by the static-pie startup so the TCB and stack-protector canary can - be initialised between the two passes. */ -# define ELF_DYNAMIC_RELOCATE_NOIFUNC(map, scope, lazy, consider_profile) \ + Unless PASS is DL_RELOC_IRELATIVE, this also performs the machine-specific + PLT/GOT setup, the DT_RELR relocations, and the ELF_DYNAMIC_AFTER_RELOC + hook. */ +# define ELF_DYNAMIC_RELOCATE_PASS(pass, map, scope, lazy, consider_profile, \ + skip_ifunc) \ do { \ - int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ + int edr_lazy = (lazy); \ + if ((pass) != DL_RELOC_IRELATIVE) \ + { \ + edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ (consider_profile)); \ - if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ - ELF_DYNAMIC_DO_RELR (map); \ - ELF_DYNAMIC_DO_REL_NOIFUNC ((map), (scope), edr_lazy); \ - ELF_DYNAMIC_DO_RELA_NOIFUNC ((map), (scope), edr_lazy); \ - ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy)); \ + if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ + ELF_DYNAMIC_DO_RELR (map); \ + } \ + ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc, (pass)); \ + ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc, (pass)); \ + if ((pass) != DL_RELOC_IRELATIVE) \ + ELF_DYNAMIC_AFTER_RELOC ((map), edr_lazy); \ } while (0) -/* IRELATIVE-only companion to ELF_DYNAMIC_RELOCATE_NOIFUNC. */ -# define ELF_DYNAMIC_RELOCATE_IFUNC(map, scope, lazy, skip_ifunc) \ - do { \ - ELF_DYNAMIC_DO_REL_IFUNCONLY ((map), (scope), (lazy), skip_ifunc); \ - ELF_DYNAMIC_DO_RELA_IFUNCONLY ((map), (scope), (lazy), skip_ifunc); \ - } while (0) +/* Run both passes back to back, for callers with nothing to interleave. */ +# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \ + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_ALL, (map), (scope), (lazy), \ + (consider_profile), skip_ifunc) #endif diff --git a/elf/tst-ifunc-fault-dep-bindnow.c b/elf/tst-ifunc-fault-dep-bindnow.c new file mode 100644 index 0000000000..60d97dcaa4 --- /dev/null +++ b/elf/tst-ifunc-fault-dep-bindnow.c @@ -0,0 +1,19 @@ +/* Program calling an IFUNC defined in a dependency. BIND_NOW variant. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include "tst-ifunc-fault-dep-lazy.c" diff --git a/elf/tst-ifunc-fault-dep-lazy.c b/elf/tst-ifunc-fault-dep-lazy.c new file mode 100644 index 0000000000..122d33f391 --- /dev/null +++ b/elf/tst-ifunc-fault-dep-lazy.c @@ -0,0 +1,27 @@ +/* Program calling an IFUNC defined in a dependency (BZ 34428). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +extern void magic (void); + +int +main (void) +{ + /* JMP_SLOT relocation against an undefined symbol. */ + magic (); + return 1; +} diff --git a/elf/tst-ifunc-fault-mod.c b/elf/tst-ifunc-fault-mod.c new file mode 100644 index 0000000000..11c21b48ac --- /dev/null +++ b/elf/tst-ifunc-fault-mod.c @@ -0,0 +1,38 @@ +/* Shared object exporting an IFUNC symbol with a resolver which crashes. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +static void +implementation (void) +{ + /* Produce a crash, without depending on any relocations. */ + volatile char *volatile p = NULL; + *p = 0; +} + +static __typeof__ (implementation) * +resolver (void) +{ + /* Produce a crash, without depending on any relocations. */ + volatile char *volatile p = NULL; + *p = 0; + return implementation; +} + +void magic (void) __attribute__ ((ifunc ("resolver"))); -- 2.55.0 From afd131806b25715a7617ab757db43f0bb610acbf Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Wed, 12 Aug 2026 09:03:17 -0300 Subject: [PATCH 25/49] m68k: Fix fmod/fmodf infinite recursion (BZ 34508) Commits 6deadd4eb6a and ade9f30ce27 changed m68k fmod to call __m81_u(fmod), instead of the mathimpl.h inline __m81_u(__ieee754_fmod) (that wraps the m68k fmod instruction). This leads to infinite recursion. Tested-by: John Paul Adrian Glaubitz (cherry picked from commit bb213471bedc177b8efd3178584137fb81cc976a) --- NEWS | 2 ++ sysdeps/m68k/m680x0/fpu/e_fmod.c | 2 +- sysdeps/m68k/m680x0/fpu/e_fmodf.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index d0ef2d3e9a..697049efd1 100644 --- a/NEWS +++ b/NEWS @@ -18,6 +18,8 @@ The following bugs are resolved with this release: [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong + [34509] libc: [m68k] Regression: Perl locks up after upgrading glibc + to 2.43 Version 2.44 diff --git a/sysdeps/m68k/m680x0/fpu/e_fmod.c b/sysdeps/m68k/m680x0/fpu/e_fmod.c index 9ad6924422..faac7c79e3 100644 --- a/sysdeps/m68k/m680x0/fpu/e_fmod.c +++ b/sysdeps/m68k/m680x0/fpu/e_fmod.c @@ -33,7 +33,7 @@ __fmod (double x, double y) && !is_nan (hx))) return __math_invalid (x); - return __m81_u(fmod)(x, y); + return __m81_u(__ieee754_fmod)(x, y); } strong_alias (__fmod, __ieee754_fmod) libm_alias_finite (__ieee754_fmod, __fmod) diff --git a/sysdeps/m68k/m680x0/fpu/e_fmodf.c b/sysdeps/m68k/m680x0/fpu/e_fmodf.c index a3bd24b71f..98797e0887 100644 --- a/sysdeps/m68k/m680x0/fpu/e_fmodf.c +++ b/sysdeps/m68k/m680x0/fpu/e_fmodf.c @@ -34,7 +34,7 @@ __fmodf (float x, float y) && !is_nan (hx))) return __math_invalidf (x); - return __m81_u(fmodf)(x, y); + return __m81_u(__ieee754_fmodf)(x, y); } strong_alias (__fmodf, __ieee754_fmodf) versioned_symbol (libm, __fmodf, fmodf, GLIBC_2_43); -- 2.55.0 From d6ff274313d79feb864cc10eb775b91c817a67e9 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 14 Aug 2026 13:41:16 +0200 Subject: [PATCH 26/49] misc: Fix out-of-bounds array write in tdelete (bug 34506) Allocate the maximum array sizes directly, instead of resizing the arrays as needed. This eliminates alloca usage from the function, and fixes the out-of-bounds accesses. The asserts guard against the bug coming back if the balancing of the tree turns out not to work correctly. Reviewed-by: Adhemerval Zanella (cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3) --- misc/tsearch.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/misc/tsearch.c b/misc/tsearch.c index 9b2eb34b25..e517dfa712 100644 --- a/misc/tsearch.c +++ b/misc/tsearch.c @@ -85,6 +85,7 @@ #include #include #include +#include #include #include #include @@ -406,12 +407,13 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) int cmp; node *rootp = (node *) vrootp; node root, unchained; - /* Stack of nodes so we remember the parents without recursion. It's - _very_ unlikely that there are paths longer than 40 nodes. The tree - would need to have around 250.000 nodes. */ - int stacksize = 40; + /* Stack of nodes so we remember the parents without recursion. The + stack size is a conservative approximation of the maximum height + of a red-black tree, based on size of the address space. + Actual numbers are closer to 57 (32 bit) and 117 (63 bit). */ + enum { stacksize = 2 * UINTPTR_WIDTH }; int sp = 0; - node **nodestack = alloca (sizeof (node *) * stacksize); + node *nodestack[stacksize]; if (rootp == NULL) return NULL; @@ -424,14 +426,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) root = DEREFNODEPTR(rootp); while ((cmp = (*compar) (key, root->key)) != 0) { - if (sp == stacksize) - { - node **newstack; - stacksize += 20; - newstack = alloca (sizeof (node *) * stacksize); - nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); - } - + assert (sp < stacksize); nodestack[sp++] = rootp; p = DEREFNODEPTR(rootp); if (cmp < 0) @@ -470,13 +465,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) node upn; for (;;) { - if (sp == stacksize) - { - node **newstack; - stacksize += 20; - newstack = alloca (sizeof (node *) * stacksize); - nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); - } + assert (sp < stacksize); nodestack[sp++] = parentp; parentp = up; upn = DEREFNODEPTR(up); @@ -541,6 +530,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) SETNODEPTR(pp,q); /* Make sure pp is right if the case below tries to use it. */ + assert (sp < stacksize); nodestack[sp++] = pp = LEFTPTR(q); q = RIGHT(p); } @@ -625,6 +615,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) SETLEFT(p,RIGHT(q)); SETRIGHT(q,p); SETNODEPTR(pp,q); + assert (sp < stacksize); nodestack[sp++] = pp = RIGHTPTR(q); q = LEFT(p); } -- 2.55.0 From ae9225d55963c4420c49ccfa3f2fafc416f92032 Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Mon, 24 Aug 2026 18:00:26 +0200 Subject: [PATCH 27/49] m68k: remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c (bug 34559) This was missed from commit 6deadd4eb6. (cherry picked from commit ff1c5580610dee6d743169fc0f6684505d372dc9) --- sysdeps/m68k/m680x0/fpu/w_fmod_compat.c | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 sysdeps/m68k/m680x0/fpu/w_fmod_compat.c diff --git a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c b/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c deleted file mode 100644 index 57f38091e6..0000000000 --- a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c +++ /dev/null @@ -1,15 +0,0 @@ -/* m68k provides an optimized __ieee752_fmod. */ -#include -#ifdef SHARED -# undef SHLIB_COMPAT -# define SHLIB_COMPAT(a, b, c) 1 -# undef LIBM_SVID_COMPAT -# define LIBM_SVID_COMPAT 1 -# undef compat_symbol -# define compat_symbol(a, b, c, d) -#include -libm_alias_double (__fmod_compat, fmod) -#else -#include -#include -#endif -- 2.55.0 From 9c48b91ee34431f19fca47bf31e2f2ef77c119d5 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 13 Aug 2026 08:53:06 -0300 Subject: [PATCH 28/49] posix: Remove unnecessary overflow check in wordexp (BZ 34090) The WRDE_APPEND path duplicates the caller's we_wordv array, which already holds we_offs + we_wordc + 1 pointers. Follow-up to commit e2cefe16c37. Checked on x86_64-linux-gnu and i686-linux-gnu. (cherry picked from commit 53ec26f1736aee747b353aaea0667b1ebdd5cae7) --- posix/wordexp.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/posix/wordexp.c b/posix/wordexp.c index 8fdc8b8caf..9a49e102ee 100644 --- a/posix/wordexp.c +++ b/posix/wordexp.c @@ -35,7 +35,6 @@ #include #include <_itoa.h> #include -#include /* * This is a recursive-descent-style word expansion routine. @@ -2269,16 +2268,14 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) { /* WRDE_APPEND with an existing word list: duplicate the array so that realloc during parsing does not invalidate the caller's pointer. The - strings themselves are shared. */ - size_t num_p; - char **dup; - if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p) - || INT_ADD_WRAPV (num_p, 1, &num_p)) - return WRDE_NOSPACE; - dup = __libc_reallocarray (NULL, num_p, sizeof *dup); + strings themselves are shared an the array already holds + 'we_offs + we_wordc + 1 pointers' (so the size computation cannot + overflow). */ + size_t num_p = pwordexp->we_offs + pwordexp->we_wordc + 1; + char **dup = malloc (num_p * sizeof (char *)); if (dup == NULL) return WRDE_NOSPACE; - memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup); + memcpy (dup, pwordexp->we_wordv, num_p * sizeof (char *)); saved_wordv = pwordexp->we_wordv; pwordexp->we_wordv = dup; } -- 2.55.0 From 63b53df549451a5d69fcba6d7612ea99f517e8e3 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 27 Aug 2026 13:34:54 +0200 Subject: [PATCH 29/49] stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499) The memmove call did not take into account that __printf_buffer_pad updated the buffer pointers. Fixes commit e88b9f0e5cc50cab57a299dc7efe1a4eb385161d ("stdio-common: Convert vfprintf and related functions to buffers"), which went into glibc 2.37. Reviewed-by: Adhemerval Zanella (cherry picked from commit b090cf226ff65b913e41536f1f573f500855615c) --- stdlib/Makefile | 1 + stdlib/strfmon_l.c | 5 +++-- stdlib/tst-strfmon-bug34510.c | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 stdlib/tst-strfmon-bug34510.c diff --git a/stdlib/Makefile b/stdlib/Makefile index addf7dc99f..16948eb512 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -347,6 +347,7 @@ tests := \ tst-stdc_leading_zeros \ tst-stdc_trailing_ones \ tst-stdc_trailing_zeros \ + tst-strfmon-bug34510 \ tst-strfmon_l \ tst-strfrom \ tst-strfrom-locale \ diff --git a/stdlib/strfmon_l.c b/stdlib/strfmon_l.c index f864289480..c39babaeae 100644 --- a/stdlib/strfmon_l.c +++ b/stdlib/strfmon_l.c @@ -549,7 +549,8 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, /* Now test whether the output width is filled. */ if (buf->write_ptr - startp < width) { - size_t pad_width = width - (buf->write_ptr - startp); + size_t written_width = buf->write_ptr - startp; + size_t pad_width = width - written_width; __printf_buffer_pad (buf, ' ', pad_width); if (__printf_buffer_has_failed (buf)) /* Implies length check. */ @@ -558,7 +559,7 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, Otherwise move the field contents in place. */ if (!left) { - memmove (startp + pad_width, startp, buf->write_ptr - startp); + memmove (startp + pad_width, startp, written_width); memset (startp, ' ', pad_width); } } diff --git a/stdlib/tst-strfmon-bug34510.c b/stdlib/tst-strfmon-bug34510.c new file mode 100644 index 0000000000..b187bde1f4 --- /dev/null +++ b/stdlib/tst-strfmon-bug34510.c @@ -0,0 +1,33 @@ +/* Test handling of right-padding in strfmon (bug 34510, CVE-2026-19499). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include + +static int +do_test (void) +{ + struct support_next_to_fault ntf = support_next_to_fault_allocate (100); + TEST_COMPARE (strfmon (ntf.buffer, ntf.length, "%100n", 1.23), -1); + TEST_COMPARE (errno, E2BIG); + return 0; +} + +#include -- 2.55.0 From 6f9b2bfa500bf5d1cff5d990adfff4b71298dadd Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 28 Aug 2026 10:26:07 +0200 Subject: [PATCH 30/49] iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117) This fixes bug 34556. Reviewed-by: Carlos O'Donell (cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3) --- iconvdata/shift_jisx0213.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c index 61c9c3ce6d..e9179f605e 100644 --- a/iconvdata/shift_jisx0213.c +++ b/iconvdata/shift_jisx0213.c @@ -226,6 +226,9 @@ STANDARD_FROM_LOOP_ERR_HANDLER (1); \ } \ } \ + else \ + /* There was a pending character. Clear it. */ \ + *statep = 0; \ \ put32 (outptr, ch); \ outptr += 4; \ -- 2.55.0 From cb61572ea3f773e1e1978f6c412cc36a30acdb0c Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 28 Aug 2026 10:26:07 +0200 Subject: [PATCH 31/49] iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489) This fixes bug 34568. Reviewed-by: Carlos O'Donell (cherry picked from commit 4dafa087ff5fe7df45bd37dc727e988da6b8c935) --- iconvdata/euc-jisx0213.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/iconvdata/euc-jisx0213.c b/iconvdata/euc-jisx0213.c index 5572bbdb7b..61c22231e1 100644 --- a/iconvdata/euc-jisx0213.c +++ b/iconvdata/euc-jisx0213.c @@ -224,6 +224,9 @@ STANDARD_FROM_LOOP_ERR_HANDLER (1); \ } \ } \ + else \ + /* There was a pending character. Clear it. */ \ + *statep = 0; \ \ put32 (outptr, ch); \ outptr += 4; \ -- 2.55.0 From ca54198decdc3be693b010687f8de716a750b0e4 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 28 Aug 2026 10:26:07 +0200 Subject: [PATCH 32/49] iconvdata: Test case for bug 34556, bug 34568 Assisted-by: LLM Reviewed-by: Carlos O'Donell (cherry picked from commit 35efcffa97553df071bc37ab31fd7dc2c634e7da) --- iconvdata/Makefile | 5 +- iconvdata/tst-jisx0213-progress.c | 124 ++++++++++++++++++++++++++++++ 2 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 iconvdata/tst-jisx0213-progress.c diff --git a/iconvdata/Makefile b/iconvdata/Makefile index fbb0067302..ba2eec2b48 100644 --- a/iconvdata/Makefile +++ b/iconvdata/Makefile @@ -76,7 +76,8 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \ bug-iconv13 bug-iconv14 bug-iconv15 \ - tst-iconv-iso-2022-cn-ext tst-bug33980 + tst-iconv-iso-2022-cn-ext tst-bug33980 \ + tst-jisx0213-progress ifeq ($(have-thread-library),yes) tests += bug-iconv3 endif @@ -335,6 +336,8 @@ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so)) $(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \ $(addprefix $(objpfx),$(modules.so)) +$(objpfx)tst-jisx0213-progress.out: \ + $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so)) $(objpfx)iconv-test.out: run-iconv-test.sh \ $(addprefix $(objpfx), $(gconv-modules)) \ diff --git a/iconvdata/tst-jisx0213-progress.c b/iconvdata/tst-jisx0213-progress.c new file mode 100644 index 0000000000..7b2073be1f --- /dev/null +++ b/iconvdata/tst-jisx0213-progress.c @@ -0,0 +1,124 @@ +/* Test JISX0213 combining character conversion progress (bug 34556, bug 34568). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* Certain JISX0213 byte sequences map to a combining sequence, for + example U+304B (HIRAGANA LETTER KA) followed by U+309A (COMBINING + SEMI-VOICED SOUND MARK). When converting to internal encoding + (actually UTF-32) with a small output buffer, the first code point + is emitted and the second is queued in the converter state. This + test verifies that the queued code point is consumed exactly once + on retry, so that the conversion makes progress and terminates. */ + +#include +#include +#include +#include + +#include +#include + +static void +test_one (const char *charset, const char *input, size_t outbufsize) +{ + printf ("info: %s: testing output buffer size %zu\n", charset, outbufsize); + + /* Expected UTF-32 output. */ + static const wchar_t expected[] = { 0x304b, 0x309a, 'A' }; + + /* Use WCHAR_T encoding to avoid the BOM. */ + iconv_t cd = iconv_open ("WCHAR_T", charset); + TEST_VERIFY_EXIT (cd != (iconv_t) -1); + + char result[64]; + size_t result_len = 0; + + char *inptr = (char *) input; + size_t inleft = strlen (input); + + char outbuf[64]; + + int iterations = 0; + while (inleft > 0) + { + char *outptr = outbuf; + size_t outleft = outbufsize; + size_t inleft_before = inleft; + + size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft); + size_t produced = outptr - outbuf; + + TEST_VERIFY_EXIT (result_len + produced <= sizeof (result)); + memcpy (result + result_len, outbuf, produced); + result_len += produced; + + if (ret == (size_t) -1 && errno == E2BIG) + { + if (produced == 0 && inleft == inleft_before) + { + /* Output buffer too small for a single code point. */ + TEST_VERIFY_EXIT (outbufsize < 4); + break; + } + /* Bound iterations to detect non-progress bugs. */ + if (++iterations < 10) + continue; + else + { + FAIL ("%s: no progress", charset); + goto out; + } + } + if (ret == (size_t) -1) + FAIL_EXIT1 ("outbufsize %zu: iconv: %m", outbufsize); + break; + } + + /* Flush pending converter state. */ + { + char *outptr = outbuf; + size_t outleft = outbufsize; + size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft); + TEST_VERIFY (ret == 0); + size_t produced = outptr - outbuf; + memcpy (result + result_len, outbuf, produced); + result_len += produced; + } + + if (outbufsize >= 4) + { + TEST_COMPARE (inleft, 0); + TEST_COMPARE_BLOB (result, result_len, + expected, sizeof (expected)); + } + + out: + TEST_VERIFY_EXIT (iconv_close (cd) == 0); +} + +static int +do_test (void) +{ + for (size_t outbufsize = 1; outbufsize <= 16; outbufsize++) + { + test_one ("EUC-JISX0213", "\244\367A", outbufsize); + test_one ("SHIFT_JISX0213", "\202\365A", outbufsize); + } + return 0; +} + +#include -- 2.55.0 From 890f1c13f0de88678db16f8f189d43b51b77b8dc Mon Sep 17 00:00:00 2001 From: Magnus Lindholm Date: Mon, 3 Aug 2026 17:51:59 +0200 Subject: [PATCH 33/49] alpha: Fix stack alignment in makecontext The Alpha ABI requires the stack pointer to be 16-byte aligned. However, __makecontext did not realign it after reserving space for arguments. Depending on uc_stack.ss_size, this could leave the stack only 8-byte aligned. Round the new stack pointer down to a 16-byte boundary after reserving the argument area. This fixes stdlib/tst-makecontext2. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit 4a07bb292f921c10e71fbf48c4a7f44391feb06c) --- sysdeps/unix/sysv/linux/alpha/makecontext.S | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysdeps/unix/sysv/linux/alpha/makecontext.S b/sysdeps/unix/sysv/linux/alpha/makecontext.S index b0479315d5..1de0dd2653 100644 --- a/sysdeps/unix/sysv/linux/alpha/makecontext.S +++ b/sysdeps/unix/sysv/linux/alpha/makecontext.S @@ -38,6 +38,9 @@ ENTRY(__makecontext) s8addq $1, 0, $2 subq $8, $2, $8 + /* The Alpha ABI requires a 16-byte-aligned stack pointer. */ + bic $8, 15, $8 + /* Copy all parameters. Switch statement header here. */ ldah $3, $jumptable($29) !gprelhigh cmple $18, 6, $1 -- 2.55.0 From 3258c3fd9167ac5e1bfbb62b55710a139382d6a0 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Mon, 3 Aug 2026 19:55:06 -0400 Subject: [PATCH 34/49] alpha: add the denormal trap enable bit to FE_NOMASK_ENV FE_NOMASK_ENV is the floating-point environment in which no exception is masked, so it must enable every exception that FE_ALL_EXCEPT covers. On Alpha that includes the GNU extension FE_DENORMAL, whose SWCR trap enable bit is IEEE_TRAP_ENABLE_DNO (bit 6). The constant only set bits 1 through 5 (INV, DZE, OVF, UNF and INE), so after fesetenv (FE_NOMASK_ENV) a subsequent fegetexcept () returned 0x3e0000 rather than FE_ALL_EXCEPT (0x7e0000), and denormal exceptions stayed masked. Set bit 6 as well. Fixes math/test-fenv-return on alpha. Reviewed-by: Adhemerval Zanella (cherry picked from commit 8e41f6008df3b5d56df199e8b4d19891666857a4) --- sysdeps/alpha/fpu/bits/fenv.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysdeps/alpha/fpu/bits/fenv.h b/sysdeps/alpha/fpu/bits/fenv.h index b1135f1f0a..530f298914 100644 --- a/sysdeps/alpha/fpu/bits/fenv.h +++ b/sysdeps/alpha/fpu/bits/fenv.h @@ -121,7 +121,7 @@ typedef unsigned long int fenv_t; #ifdef __USE_GNU /* Floating-point environment where none of the exceptions are masked. */ -# define FE_NOMASK_ENV ((const fenv_t *) 0x880000000000003eUL) +# define FE_NOMASK_ENV ((const fenv_t *) 0x880000000000007eUL) /* Floating-point environment with (processor-dependent) non-IEEE floating point. In this case, mapping denormals to zero. */ -- 2.55.0 From 8587edfc9642b46232292b5722fec955851aa7c2 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Mon, 3 Aug 2026 19:55:09 -0400 Subject: [PATCH 35/49] alpha: expect test-float32x-float64-div to fail _Float32x and _Float64 are both binary64 on Alpha, so this narrowing divide is a plain divide and the hardware alone decides whether to signal underflow. IEEE 754 determines tininess after rounding from the result rounded as if the exponent range were unbounded, while Alpha determines it from the delivered result. The two differ for a quotient that is tiny but rounds up to the smallest normal, as in DBL_MIN / (1 + 2^-52) under a rounding mode that rounds away from zero: the binade below DBL_MIN has a finer spacing than the subnormals, so the unbounded rounding stays below DBL_MIN and the result is tiny, but the delivered result is DBL_MIN and looks normal. Alpha signals no underflow for it. Nothing in software can correct this. The hardware detects no underflow, so no software completion trap is taken and the kernel emulation never runs, and as the operation is not really narrowing there is no wider intermediate for libm to examine. Reviewed-by: Adhemerval Zanella (cherry picked from commit a32db99a38c5f0c64b414af270830c3b6e3719c1) --- sysdeps/alpha/Makefile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sysdeps/alpha/Makefile b/sysdeps/alpha/Makefile index 60a369e255..faa59ab27a 100644 --- a/sysdeps/alpha/Makefile +++ b/sysdeps/alpha/Makefile @@ -53,6 +53,20 @@ CFLAGS-s_lrint.c += -mieee-with-inexact CFLAGS-test-misc.c += -mieee-with-inexact # Avoid "conflicting types for built-in function" warnings CFLAGS-s_isnan.c += -fno-builtin-isnanf + +# _Float32x and _Float64 are both binary64 on Alpha, so this narrowing +# divide is a plain divide and the hardware alone decides whether to +# signal underflow. IEEE 754 determines tininess after rounding from the +# result rounded as if the exponent range were unbounded, but Alpha +# determines it from the delivered result. For a quotient that is tiny +# but rounds up to the smallest normal -- DBL_MIN / (1 + 2^-52) under a +# rounding mode that rounds away from zero -- the unbounded rounding +# stays below DBL_MIN, because that binade has a finer spacing than the +# subnormals, while the delivered result is DBL_MIN and looks normal. +# Alpha raises no underflow for it. No trap is taken, so the kernel +# emulation cannot correct this, and the operation has no wider +# intermediate for libm to examine. +test-xfail-test-float32x-float64-div = yes endif # Build everything with full IEEE math support, and with dynamic rounding; -- 2.55.0 From 2d5421ffca8893534d5e02ad38c28acd8e778fa3 Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Wed, 26 Aug 2026 15:18:35 +0800 Subject: [PATCH 36/49] Add check-symbol-version.awk commit 6deadd4eb6ab4f59d116b2d7ad97be0d0848cb7f Author: Adhemerval Zanella Date: Wed Oct 8 10:55:05 2025 -0300 didn't remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c. As the result, due to a linker bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34550 there were 2 default versions of fmod in m68k libm: 996: 0001433c 174 FUNC WEAK DEFAULT 12 fmod@@GLIBC_2.0 997: 000307d4 214 FUNC GLOBAL DEFAULT 12 fmod@@GLIBC_2.43 Add check-symbol-version.awk to verify that versioned symbols only have one default version in dynamic symbol table. Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit 0e57c798c68eaf229a9fa8cb02179e43d4f8581a) --- elf/Makefile | 7 ++++ scripts/check-symbol-version.awk | 67 ++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 scripts/check-symbol-version.awk diff --git a/elf/Makefile b/elf/Makefile index d279a5135c..54a4339148 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -1432,6 +1432,7 @@ tests-special += \ $(objpfx)check-execstack.out \ $(objpfx)check-initfini.out \ $(objpfx)check-localplt.out \ + $(objpfx)check-symbol-version.out \ $(objpfx)check-textrel.out \ $(objpfx)check-wx-segment.out \ # tests-special @@ -2377,6 +2378,12 @@ $(objpfx)check-initfini.out: $(..)scripts/check-initfini.awk \ $(evaluate-test) generated += check-initfini.out +$(objpfx)check-symbol-version.out: $(..)scripts/check-symbol-version.awk \ + $(all-built-dso:=.dynsym) + LC_ALL=C $(AWK) -f $^ > $@; \ + $(evaluate-test) +generated += check-symbol-version.out + $(objpfx)tst-dlopenrpath: $(objpfx)tst-dlopenrpathmod.so CFLAGS-tst-dlopenrpath.c += -DPFX=\"$(objpfx)\" LDFLAGS-tst-dlopenrpathmod.so += -Wl,-rpath,\$$ORIGIN/test-subdir diff --git a/scripts/check-symbol-version.awk b/scripts/check-symbol-version.awk new file mode 100644 index 0000000000..2ddaa0edc9 --- /dev/null +++ b/scripts/check-symbol-version.awk @@ -0,0 +1,67 @@ +# Copyright (C) 2026 Free Software Foundation, Inc. +# This file is part of the GNU C Library. + +# The GNU C Library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. + +# The GNU C Library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. + +# You should have received a copy of the GNU Lesser General Public +# License along with the GNU C Library; if not, see +# . + +# This awk script expects to get command-line files that are each +# the output of 'readelf -W --dyn-syms' on a single shared object. +# It exits successfully (0) if there are versioned symbols with more +# than one default version in dynamic symbol table. +# It fails (1) if any did contain versioned symbols with more than one +# default version in dynamic symbol table. +# It fails (2) if the input did not take the expected form. + +BEGIN { result = incorrect = sanity = 0 } + +function check_one(name) { + if (!sanity) { + print name ": *** input did not look like readelf -d output"; + result = 2; + } else { + ok = 1; + if (incorrect) { + print name ": *** incorrect dynamic symbol table"; + result = result ? result : 1; + ok = 0; + } + if (ok) + print name ": OK"; + } + + delete version + incorrect = sanity = 0 +} + +FILENAME != lastfile { + if (lastfile) + check_one(lastfile); + lastfile = FILENAME; +} + +$1 == "Symbol" && $2 == "table" && $3 == "'.dynsym'" { sanity = 1 } +$8 ~ "@@" { + split($8,a,"@"); + if (version[a[1]] != "") { + incorrect = 1; + print a[1] " has 2 default versions: " version[a[1]] ", " a[3]; + } else { + version[a[1]] = a[3]; + } +} + +END { + check_one(lastfile); + exit(result); +} -- 2.55.0 From 93606c5c1d2a571abf5d2e8af66e4f0aee9c67ba Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 18 Aug 2026 21:48:34 +0200 Subject: [PATCH 37/49] powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530) After commit 78f1f0e39cd41d28ae771eb3498bc33780c85cfd ("Consolidate the C pointer guard and align the assembly implementations"), PTR_DEMANGLE3 on POWER no longer atomically updates the destination register. The fortified longjmp relies on atomic update of the stack pointer (r1) in sysdeps/powerpc/powerpc64/__longjmp-common.S and parallel files: #ifdef PTR_DEMANGLE # ifdef CHECK_SP PTR_DEMANGLE3 (r22, r22, r25) # else PTR_DEMANGLE3 (r1, r22, r25) # endif #endif Fix this by using PTR_DEMANGLE instead of PTR_DEMANGLE3. Remove PTR_MANGLE3 and PTR_DEMANGLE3 as unused. An alternate fix would store the pointer guard cookie rotated, but this would go against the unification in the commit that introduced the regression. Reviewed-by: Adhemerval Zanella (cherry picked from commit 24d188a2a149b9933e17240e454f917e065cdf06) --- sysdeps/powerpc/powerpc32/__longjmp-common.S | 10 ++++------ sysdeps/powerpc/powerpc32/fpu/__longjmp-common.S | 11 ++++------- sysdeps/powerpc/powerpc64/__longjmp-common.S | 16 ++++++---------- .../unix/sysv/linux/powerpc/pointer_guard-asm.h | 8 -------- 4 files changed, 14 insertions(+), 31 deletions(-) diff --git a/sysdeps/powerpc/powerpc32/__longjmp-common.S b/sysdeps/powerpc/powerpc32/__longjmp-common.S index eb228bf4fe..9da86330f7 100644 --- a/sysdeps/powerpc/powerpc32/__longjmp-common.S +++ b/sysdeps/powerpc/powerpc32/__longjmp-common.S @@ -30,11 +30,12 @@ ENTRY (__longjmp_symbol) #if defined PTR_DEMANGLE || defined CHECK_SP lwz r24,(JB_GPR1*4)(r3) +# ifdef PTR_DEMANGLE + PTR_DEMANGLE (r24, r25) +# endif # ifdef CHECK_SP -# ifdef PTR_DEMANGLE - PTR_DEMANGLE3 (r24, r24, r25) -# endif CHECK_SP (r24) +# endif mr r1,r24 # endif #else @@ -49,9 +50,6 @@ ENTRY (__longjmp_symbol) lwz r19,((JB_GPRS+19-14)*4)(r3) lwz r20,((JB_GPRS+20-14)*4)(r3) #ifdef PTR_DEMANGLE -# ifndef CHECK_SP - PTR_DEMANGLE3 (r1, r24, r25) -# endif PTR_DEMANGLE2 (r0, r25) #endif /* longjmp/longjmp_target probe expects longjmp first argument (4@3), diff --git a/sysdeps/powerpc/powerpc32/fpu/__longjmp-common.S b/sysdeps/powerpc/powerpc32/fpu/__longjmp-common.S index c5acc1610c..8e383cc997 100644 --- a/sysdeps/powerpc/powerpc32/fpu/__longjmp-common.S +++ b/sysdeps/powerpc/powerpc32/fpu/__longjmp-common.S @@ -114,13 +114,13 @@ L(no_vmx): #endif #if defined PTR_DEMANGLE || defined CHECK_SP lwz r24,(JB_GPR1*4)(r3) +# ifdef PTR_DEMANGLE + PTR_DEMANGLE (r24, r25) +# endif # ifdef CHECK_SP -# ifdef PTR_DEMANGLE - PTR_DEMANGLE3 (r24, r24, r25) -# endif CHECK_SP (r24) - mr r1,r24 # endif + mr r1,r24 #else lwz r1,(JB_GPR1*4)(r3) #endif @@ -140,9 +140,6 @@ L(no_vmx): lwz r20,((JB_GPRS+6)*4)(r3) lfd fp20,((JB_FPRS+6*2)*4)(r3) #ifdef PTR_DEMANGLE -# ifndef CHECK_SP - PTR_DEMANGLE3 (r1, r24, r25) -# endif PTR_DEMANGLE2 (r0, r25) #endif /* longjmp/longjmp_target probe expects longjmp first argument (4@3), diff --git a/sysdeps/powerpc/powerpc64/__longjmp-common.S b/sysdeps/powerpc/powerpc64/__longjmp-common.S index 99b2718677..fe8488fcac 100644 --- a/sysdeps/powerpc/powerpc64/__longjmp-common.S +++ b/sysdeps/powerpc/powerpc64/__longjmp-common.S @@ -115,19 +115,15 @@ L(no_vmx): #endif #if defined PTR_DEMANGLE || defined CHECK_SP ld r22,(JB_GPR1*8)(r3) -#else - ld r1,(JB_GPR1*8)(r3) -#endif -#ifdef PTR_DEMANGLE -# ifdef CHECK_SP - PTR_DEMANGLE3 (r22, r22, r25) -# else - PTR_DEMANGLE3 (r1, r22, r25) +# ifdef PTR_DEMANGLE + PTR_DEMANGLE (r22, r25) # endif -#endif -#ifdef CHECK_SP +# ifdef CHECK_SP CHECK_SP (r22) +# endif mr r1,r22 +#else + ld r1,(JB_GPR1*8)(r3) #endif ld r2,(JB_GPR2*8)(r3) ld r0,(JB_LR*8)(r3) diff --git a/sysdeps/unix/sysv/linux/powerpc/pointer_guard-asm.h b/sysdeps/unix/sysv/linux/powerpc/pointer_guard-asm.h index 962ad10e59..cb3e031467 100644 --- a/sysdeps/unix/sysv/linux/powerpc/pointer_guard-asm.h +++ b/sysdeps/unix/sysv/linux/powerpc/pointer_guard-asm.h @@ -65,10 +65,6 @@ # define PTR_MANGLE2(reg, tmpreg) \ xor reg,tmpreg,reg; \ PTR_ROT_MANGLE (reg, reg) -# define PTR_MANGLE3(destreg, reg, tmpreg) \ - PTR_GUARD_LOAD (tmpreg); \ - xor destreg,tmpreg,reg; \ - PTR_ROT_MANGLE (destreg, destreg) # define PTR_DEMANGLE(reg, tmpreg) \ PTR_GUARD_LOAD (tmpreg); \ PTR_ROT_DEMANGLE (reg, reg); \ @@ -76,10 +72,6 @@ # define PTR_DEMANGLE2(reg, tmpreg) \ PTR_ROT_DEMANGLE (reg, reg); \ xor reg,tmpreg,reg -# define PTR_DEMANGLE3(destreg, reg, tmpreg) \ - PTR_GUARD_LOAD (tmpreg); \ - PTR_ROT_DEMANGLE (destreg, reg); \ - xor destreg,tmpreg,destreg #endif #endif /* POINTER_GUARD_ASM_H */ -- 2.55.0 From 5c479454d1232f71c78fa21584e90a2f57883407 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 24 Aug 2026 13:38:02 -0300 Subject: [PATCH 38/49] powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530) Commit 24d188a2a149b9933e17240e454f917e065cdf06 left a stray #endif in the powerpc32 soft-float __longjmp-common.S. Remove it, matching the fpu variant. Checked with a build for powerpc32-linux-gnu-soft. (cherry picked from commit 5f5bc63a4d8a7eec7f11e56664ca76455d837b22) --- sysdeps/powerpc/powerpc32/__longjmp-common.S | 1 - 1 file changed, 1 deletion(-) diff --git a/sysdeps/powerpc/powerpc32/__longjmp-common.S b/sysdeps/powerpc/powerpc32/__longjmp-common.S index 9da86330f7..f1da933704 100644 --- a/sysdeps/powerpc/powerpc32/__longjmp-common.S +++ b/sysdeps/powerpc/powerpc32/__longjmp-common.S @@ -37,7 +37,6 @@ ENTRY (__longjmp_symbol) CHECK_SP (r24) # endif mr r1,r24 -# endif #else lwz r1,(JB_GPR1*4)(r3) #endif -- 2.55.0 From 0b4e41fc51e6aba6216a908961b49b0622b47fa0 Mon Sep 17 00:00:00 2001 From: Dongkyun Son Date: Fri, 4 Sep 2026 21:28:41 +0900 Subject: [PATCH 39/49] libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son Reviewed-by: Florian Weimer (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4) --- libio/fileops.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/libio/fileops.c b/libio/fileops.c index 9348d7c3a1..5a249725ee 100644 --- a/libio/fileops.c +++ b/libio/fileops.c @@ -355,12 +355,14 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode, *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0'; strip (ccs, ccs); - if (__wcsmbs_named_conv (&fcts, ccs[2] == '\0' - ? upstr (ccs, cs + 5) : ccs) != 0) + /* After stripping, ccs[2] == '\0' means the charset name is empty. + This is not a valid charset and would cause problems downstream. + Reject it with EINVAL (BZ #34574, CVE-2026-18374). */ + if (ccs[2] == '\0' || __wcsmbs_named_conv (&fcts, ccs) != 0) { - /* Something went wrong, we cannot load the conversion modules. - This means we cannot proceed since the user explicitly asked - for these. */ + /* Either the charset name is empty after strip(), or conversion + modules cannot be loaded. This means we cannot proceed since + the user explicitly asked for character conversion. */ (void) _IO_file_close_it (fp); free (ccs); __set_errno (EINVAL); -- 2.55.0 From 30950ce64dbc29db0aedf1d46b6b8eb70b360f0c Mon Sep 17 00:00:00 2001 From: Shamil Abdulaev Date: Thu, 3 Sep 2026 20:19:42 +0300 Subject: [PATCH 40/49] libio: Add test for fopen with an empty ", ccs=" value [BZ #34574] This goes on top of the fix for CVE-2026-18374. The test runs the reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and expects NULL with errno set to EINVAL. Signed-off-by: Shamil Abdulaev Reviewed-by: Florian Weimer (cherry picked from commit cca93e5d88d3d4ed073c03100467696f652269e7) --- libio/Makefile | 1 + libio/tst-fopen-ccs-empty.c | 62 +++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 libio/tst-fopen-ccs-empty.c diff --git a/libio/Makefile b/libio/Makefile index 616107ee10..9aec016cca 100644 --- a/libio/Makefile +++ b/libio/Makefile @@ -110,6 +110,7 @@ tests = \ tst-fgetwc \ tst-fgetws \ tst-file-init-race \ + tst-fopen-ccs-empty \ tst-fopenloc2 \ tst-fputws \ tst-freopen \ diff --git a/libio/tst-fopen-ccs-empty.c b/libio/tst-fopen-ccs-empty.c new file mode 100644 index 0000000000..64723965e1 --- /dev/null +++ b/libio/tst-fopen-ccs-empty.c @@ -0,0 +1,62 @@ +/* Test fopen with an empty ",ccs=" value in the mode string (bug 34574). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include + +static void +check_fopen_fails (const char *path, const char *mode) +{ + errno = 0; + FILE *fp = fopen (path, mode); + TEST_VERIFY (fp == NULL); + TEST_COMPARE (errno, EINVAL); + if (fp != NULL) + fclose (fp); +} + +static int +do_test (void) +{ + char *path; + xclose (create_temp_file ("tst-fopen-ccs-empty", &path)); + + /* The value is blank and the mode string continues well past it. */ + enum { size = 1024 * 1024 }; + char *mode = xmalloc (size); + memset (mode, 'X', size); + mode[size - 1] = '\0'; + static const char prefix[] = "w,ccs= ,"; + memcpy (mode, prefix, sizeof (prefix) - 1); + check_fopen_fails (path, mode); + free (mode); + + check_fopen_fails (path, "w,ccs="); + check_fopen_fails (path, "w,ccs=,"); + + free (path); + return 0; +} + +#include -- 2.55.0 From b4f51887c48ac82acfdb13f96d9eab5d120cb2b7 Mon Sep 17 00:00:00 2001 From: Hemanth Kumar M D Date: Mon, 7 Sep 2026 01:59:06 -0700 Subject: [PATCH 41/49] nptl: Skip pretty-printer tests without python3 [BZ #34507] The tests-printers-out rule in Rules wraps $(PYTHON) through $(test-wrapper-env). Unlike ordinary tests, which wrap a freshly built target binary, this wraps python3, a build-host tool. When cross-testing with test-wrapper set (e.g. via scripts/cross-test-ssh.sh) the whole command is forwarded to the target; if the target lacks python3 the shell returns 127 and evaluate-test.sh reports the six nptl pretty-printer tests as FAIL instead of UNSUPPORTED. scripts/test_printers_common.py already exits UNSUPPORTED (77) when its dependencies are missing, but that is unreachable when python3 itself is absent. Guard the invocation with a "command -v" check so the recipe exits 77 (UNSUPPORTED) when python3 is not found. Native builds are unaffected, as configure requires python3. Signed-off-by: Hemanth Kumar M D Suggested-by: Adhemerval Zanella Netto Reviewed-by: Adhemerval Zanella (cherry picked from commit c958d789db3bd8dbfb93868d8a975d13a3d66396) --- NEWS | 2 ++ Rules | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 697049efd1..a9a89bf6bc 100644 --- a/NEWS +++ b/NEWS @@ -18,6 +18,8 @@ The following bugs are resolved with this release: [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong + [34507] nptl: Pretty-printer tests FAIL instead of UNSUPPORTED when + cross-testing without python3 on target [34509] libc: [m68k] Regression: Perl locks up after upgrading glibc to 2.43 diff --git a/Rules b/Rules index 71495028fb..cfdbb459c8 100644 --- a/Rules +++ b/Rules @@ -467,8 +467,9 @@ py-env := PYTHONPATH=$(py-const-dir):$(..)scripts:$${PYTHONPATH} # The pretty printer files and test_common_printers.py must be present for all. $(tests-printers-out): $(objpfx)%.out: $(objpfx)% %.py %.c $(pretty-printers) \ $(..)scripts/test_printers_common.py - $(test-wrapper-env) $(py-env) \ - $(PYTHON) $*.py $*.c $(objpfx)$* $(pretty-printers) > $@; \ + $(test-wrapper-env) $(py-env) sh -c \ + 'command -v $(firstword $(PYTHON)) > /dev/null 2>&1 || exit 77; \ + exec $(PYTHON) $*.py $*.c $(objpfx)$* $(pretty-printers)' > $@; \ $(evaluate-test) endif -- 2.55.0 From b84047b5b792e1f028f4d82acbfa9ee9f6e89069 Mon Sep 17 00:00:00 2001 From: Shamil Abdulaev Date: Fri, 11 Sep 2026 14:59:48 +0200 Subject: [PATCH 42/49] elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600] Since b9957a70b8 the cache extensions are loaded in _dl_maybe_load_ldsocache. A cache written by "ldconfig -c old" has no new-format header, so tmp_cache_new is NULL there and cache_extension_load dereferences it. Because __tunables_init loads the cache unconditionally, ld.so crashes at startup of every dynamically linked program. An old-format cache cannot carry extensions, so return early instead. Checked on x86_64-linux-gnu. Signed-off-by: Shamil Abdulaev Reviewed-by: Florian Weimer (cherry picked from commit fa91c51bb7bdd47ba4a1bb0ee7d66be101032ba5) --- elf/Makefile | 4 +- elf/tst-dl-cache-old-format.c | 144 ++++++++++++++++++ .../postclean.req | 0 sysdeps/generic/dl-cache.h | 3 + 4 files changed, 150 insertions(+), 1 deletion(-) create mode 100644 elf/tst-dl-cache-old-format.c create mode 100644 elf/tst-dl-cache-old-format.root/postclean.req diff --git a/elf/Makefile b/elf/Makefile index 54a4339148..f1a8a75fdc 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -306,6 +306,7 @@ tst-ifunc-resolver-protector-static-non-pie-no-pie = yes tests-container := \ tst-dl-cache-long-path \ + tst-dl-cache-old-format \ tst-ldconfig-bad-aux-cache \ tst-ldconfig-ld_so_conf-update \ # tests-container @@ -3043,9 +3044,10 @@ LDFLAGS-tst-dlopen-nodelete-reloc-mod17.so = -Wl,--no-as-needed $(objpfx)tst-ldconfig-ld_so_conf-update.out: $(objpfx)tst-ldconfig-ld-mod.so -# Reuses the trivial module already built for tst-dl-path-buf. $(objpfx)tst-dl-cache-long-path: $(shared-thread-library) +# Both cache tests reuse the trivial module already built for tst-dl-path-buf. $(objpfx)tst-dl-cache-long-path.out: $(objpfx)tst-dl-path-buf-mod.so +$(objpfx)tst-dl-cache-old-format.out: $(objpfx)tst-dl-path-buf-mod.so LDFLAGS-tst-dst-needed-leaf-mod.so = \ -Wl,-soname,\$$ORIGIN/\$$ORIGIN/\$$ORIGIN/\$$ORIGIN/\$$ORIGIN/leaf.so diff --git a/elf/tst-dl-cache-old-format.c b/elf/tst-dl-cache-old-format.c new file mode 100644 index 0000000000..985aed99ec --- /dev/null +++ b/elf/tst-dl-cache-old-format.c @@ -0,0 +1,144 @@ +/* Test that ld.so accepts an ld.so.cache written in the old format. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* A cache written by "ldconfig -c old" carries no new-format header, so + the loader must not look for cache extensions in it. The test writes + such a cache, then starts a dynamically linked child, which is where + an unpatched loader dies before main, and then dlopens a module that + is only reachable through the cache, which covers the reload path. */ + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +/* ldconfig only indexes file names starting with "lib", so the module is + deployed under a lib-prefixed name and dlopened by that name. */ +#define MOD_BUILT "tst-dl-path-buf-mod.so" +#define MOD_DEPLOYED "libtst-dl-path-buf-mod.so" +#define MOD_SYMBOL "tst_dl_path_buf_mod_value" +#define MOD_EXPECTED 0xaabbccddu + +#define MOD_DIR "/tst-dl-cache-old-format" + +/* Copied from sysdeps/generic/dl-cache.h, which cannot be included here + because it relies on libc-internal attributes. */ +#define CACHE_MAGIC_OLD "ld.so-1.7.0" +#define CACHE_MAGIC_NEW "glibc-ld.so.cache1.1" + +/* Set in the re-executed child, whose only job is to reach main. */ +static int restart; +#define CMDLINE_OPTIONS \ + { "restart", no_argument, &restart, 1 }, + +static void +run_ldconfig (void *closure __attribute__ ((unused))) +{ + char *prog = xasprintf ("%s/ldconfig", support_install_rootsbindir); + char *args[] = { prog, (char *) "-c", (char *) "old", NULL }; + execv (args[0], args); + FAIL_EXIT1 ("execv (%s): %m", prog); +} + +/* ldconfig accepts an unknown -c argument without complaining and falls + back to the new format, so verify that the cache on disk really is the + old format and carries no new-format header anywhere. */ +static void +check_cache_is_old_format (void) +{ + char *path = xasprintf ("%s/ld.so.cache", support_sysconfdir_prefix); + int fd = xopen (path, O_RDONLY, 0); + struct stat64 st; + xfstat64 (fd, &st); + size_t length = st.st_size; + char *contents = xmalloc (length); + xread (fd, contents, length); + xclose (fd); + + TEST_COMPARE_BLOB (contents, sizeof CACHE_MAGIC_OLD - 1, + CACHE_MAGIC_OLD, sizeof CACHE_MAGIC_OLD - 1); + TEST_VERIFY (memmem (contents, length, CACHE_MAGIC_NEW, + sizeof CACHE_MAGIC_NEW - 1) == NULL); + + free (contents); + free (path); +} + +static void +do_prepare (int argc, char **argv) +{ + if (restart) + return; + + xmkdirp (MOD_DIR, 0777); + add_temp_file (MOD_DIR); + char *src = xasprintf ("%s/elf/" MOD_BUILT, support_objdir_root); + support_copy_file (src, MOD_DIR "/" MOD_DEPLOYED); + add_temp_file (MOD_DIR "/" MOD_DEPLOYED); + free (src); + + char *conf = xasprintf ("%s/ld.so.conf", support_sysconfdir_prefix); + support_write_file_string (conf, MOD_DIR "\n"); + free (conf); + + xmkdirp ("/var/cache/ldconfig", 0777); + struct support_capture_subprocess result + = support_capture_subprocess (run_ldconfig, NULL); + support_capture_subprocess_check (&result, "ldconfig", 0, sc_allow_none); + support_capture_subprocess_free (&result); + + check_cache_is_old_format (); +} +#define PREPARE do_prepare + +static int +do_test (int argc, char **argv) +{ + if (restart) + /* Reaching main is the entire check: the loader read the old-format + cache while starting this process. */ + return 0; + + char *spargv[] = { argv[0], (char *) "--direct", (char *) "--restart", + NULL }; + struct support_capture_subprocess result + = support_capture_subprogram (spargv[0], spargv, NULL); + support_capture_subprocess_check (&result, "restart", 0, sc_allow_none); + support_capture_subprocess_free (&result); + + /* This process still has the cache from its own startup mapped, so the + dlopen exercises the reload of the replaced file as well. */ + void *handle = xdlopen (MOD_DEPLOYED, RTLD_NOW | RTLD_LOCAL); + unsigned int (*value) (void) = xdlsym (handle, MOD_SYMBOL); + TEST_COMPARE (value (), MOD_EXPECTED); + xdlclose (handle); + + return 0; +} + +#define TEST_FUNCTION_ARGV do_test +#include diff --git a/elf/tst-dl-cache-old-format.root/postclean.req b/elf/tst-dl-cache-old-format.root/postclean.req new file mode 100644 index 0000000000..e69de29bb2 diff --git a/sysdeps/generic/dl-cache.h b/sysdeps/generic/dl-cache.h index 972ab32b86..b1de245438 100644 --- a/sysdeps/generic/dl-cache.h +++ b/sysdeps/generic/dl-cache.h @@ -321,6 +321,9 @@ cache_extension_load (const struct cache_file_new *cache, struct cache_extension_all_loaded *loaded) { memset (loaded, 0, sizeof (*loaded)); + if (cache == NULL) + /* Old-format cache without a new-format header, so no extensions. */ + return true; if (cache->extension_offset == 0) /* No extensions present. This is not a format error. */ return true; -- 2.55.0 From b14c4b0bc95c25f9718807be07ad9a13442d2b6f Mon Sep 17 00:00:00 2001 From: Sam James Date: Sat, 29 Aug 2026 16:54:46 +0100 Subject: [PATCH 43/49] io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313] Since Linux 6.11, AT_EMPTY_PATH can be used for a NULL path argument, so the nonnull attribute is no longer sound. Drop it. This bug was worked around in gnulib's 6db27b4dd36eda618db20e997ff56bbed7fce3cb. See also 55618e13968a60b89e5b226a23afaa8f17c5ef48 which fixed fstatat in glibc. Bug: https://sourceware.org/PR34313 --- io/sys/stat.h | 2 +- posix/unistd.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/io/sys/stat.h b/io/sys/stat.h index 3069e187b0..ff70b69f59 100644 --- a/io/sys/stat.h +++ b/io/sys/stat.h @@ -370,7 +370,7 @@ extern int fchmod (int __fd, __mode_t __mode) __THROW; the directory FD is open on. */ extern int fchmodat (int __fd, const char *__file, __mode_t __mode, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use ATFILE. */ diff --git a/posix/unistd.h b/posix/unistd.h index 06a6a88b52..dc5c2ec009 100644 --- a/posix/unistd.h +++ b/posix/unistd.h @@ -307,7 +307,7 @@ extern int execveat (int __fd, const char *__path, char *const __argv[], If AT_EACCESS is set in FLAG, then use effective IDs like `eaccess', otherwise use real IDs like `access'. */ extern int faccessat (int __fd, const char *__file, int __type, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use GNU. */ @@ -510,7 +510,7 @@ extern int lchown (const char *__file, __uid_t __owner, __gid_t __group) on. */ extern int fchownat (int __fd, const char *__file, __uid_t __owner, __gid_t __group, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use GNU. */ /* Change the process's working directory to PATH. */ -- 2.55.0 From d19791b12ae5f054187ebe93a653c0ef90447a4f Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Wed, 16 Sep 2026 08:22:35 +0800 Subject: [PATCH 44/49] x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed Link tst-shstk-legacy-1f and tst-shstk-legacy-1g with -Wl,--no-as-needed so that tst-shstk-legacy-mod-1.so is added to DT_NEEDED. This fixes BZ #31877. Signed-off-by: H.J. Lu Reviewed-by: Aurelien Jarno (cherry picked from commit 1db83d1652d35115525960021e4fb5b76dd1c633) --- sysdeps/x86_64/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile index ff0463d7ca..dfb344d74a 100644 --- a/sysdeps/x86_64/Makefile +++ b/sysdeps/x86_64/Makefile @@ -467,10 +467,12 @@ $(objpfx)tst-shstk-legacy-1e-static.out: \ $(SHELL) $< $(common-objpfx) 2> $@; \ $(evaluate-test) tst-shstk-legacy-1f-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +LDFLAGS-tst-shstk-legacy-1f = -Wl,--no-as-needed $(objpfx)tst-shstk-legacy-1f: $(objpfx)tst-shstk-legacy-mod-1.so $(objpfx)tst-shstk-legacy-mod-1.so: \ $(objpfx)tst-shstk-legacy-mod-1.os \ $(objpfx)tst-shstk-legacy-1-extra.os +LDFLAGS-tst-shstk-legacy-1g = -Wl,--no-as-needed $(objpfx)tst-shstk-legacy-1g: $(objpfx)tst-shstk-legacy-mod-1.so $(objpfx)tst-shstk-legacy-1g.out: \ $(..)/sysdeps/x86_64/tst-shstk-legacy-1g.sh $(objpfx)tst-shstk-legacy-1g -- 2.55.0 From d7179269b79eb7394e980cb8ebd810629c686f0f Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Sep 2026 02:04:11 +0100 Subject: [PATCH 45/49] Revert "io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]" This reverts commit b14c4b0bc95c25f9718807be07ad9a13442d2b6f. --- io/sys/stat.h | 2 +- posix/unistd.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/io/sys/stat.h b/io/sys/stat.h index ff70b69f59..3069e187b0 100644 --- a/io/sys/stat.h +++ b/io/sys/stat.h @@ -370,7 +370,7 @@ extern int fchmod (int __fd, __mode_t __mode) __THROW; the directory FD is open on. */ extern int fchmodat (int __fd, const char *__file, __mode_t __mode, int __flag) - __THROW __wur; + __THROW __nonnull ((2)) __wur; #endif /* Use ATFILE. */ diff --git a/posix/unistd.h b/posix/unistd.h index dc5c2ec009..06a6a88b52 100644 --- a/posix/unistd.h +++ b/posix/unistd.h @@ -307,7 +307,7 @@ extern int execveat (int __fd, const char *__path, char *const __argv[], If AT_EACCESS is set in FLAG, then use effective IDs like `eaccess', otherwise use real IDs like `access'. */ extern int faccessat (int __fd, const char *__file, int __type, int __flag) - __THROW __wur; + __THROW __nonnull ((2)) __wur; #endif /* Use GNU. */ @@ -510,7 +510,7 @@ extern int lchown (const char *__file, __uid_t __owner, __gid_t __group) on. */ extern int fchownat (int __fd, const char *__file, __uid_t __owner, __gid_t __group, int __flag) - __THROW __wur; + __THROW __nonnull ((2)) __wur; #endif /* Use GNU. */ /* Change the process's working directory to PATH. */ -- 2.55.0 From e58294a5a7e37971ab3827efbd0469ac6a19e4b8 Mon Sep 17 00:00:00 2001 From: Sam James Date: Sat, 29 Aug 2026 16:54:46 +0100 Subject: [PATCH 46/49] io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313] Since Linux 6.11, AT_EMPTY_PATH can be used for a NULL path argument, so the nonnull attribute is no longer sound. Drop it. This bug was worked around in gnulib's 6db27b4dd36eda618db20e997ff56bbed7fce3cb. See also 55618e13968a60b89e5b226a23afaa8f17c5ef48 which fixed fstatat in glibc. Bug: https://sourceware.org/PR34313 Reviewed-by: Paul Eggert (cherry picked from commit 5bcfeca12b295908453c9045965842feb9e63ced) --- io/sys/stat.h | 2 +- posix/unistd.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/io/sys/stat.h b/io/sys/stat.h index 3069e187b0..ff70b69f59 100644 --- a/io/sys/stat.h +++ b/io/sys/stat.h @@ -370,7 +370,7 @@ extern int fchmod (int __fd, __mode_t __mode) __THROW; the directory FD is open on. */ extern int fchmodat (int __fd, const char *__file, __mode_t __mode, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use ATFILE. */ diff --git a/posix/unistd.h b/posix/unistd.h index 06a6a88b52..dc5c2ec009 100644 --- a/posix/unistd.h +++ b/posix/unistd.h @@ -307,7 +307,7 @@ extern int execveat (int __fd, const char *__path, char *const __argv[], If AT_EACCESS is set in FLAG, then use effective IDs like `eaccess', otherwise use real IDs like `access'. */ extern int faccessat (int __fd, const char *__file, int __type, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use GNU. */ @@ -510,7 +510,7 @@ extern int lchown (const char *__file, __uid_t __owner, __gid_t __group) on. */ extern int fchownat (int __fd, const char *__file, __uid_t __owner, __gid_t __group, int __flag) - __THROW __nonnull ((2)) __wur; + __THROW __wur; #endif /* Use GNU. */ /* Change the process's working directory to PATH. */ -- 2.55.0 From e01330dcec96ddc3495bb3c62fe59e4fc9bbe083 Mon Sep 17 00:00:00 2001 From: Sam James Date: Sat, 29 Aug 2026 17:02:29 +0100 Subject: [PATCH 47/49] fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313] .. and openat64. Linux 7.2 (31cf44efa6df72a524b40adefb80539f3a4e13ba) allows openat, openat2 to take a NULL path with the new O_EMPTYPATH flag, so the nonnull attribute is no longer sound. Drop it. Bug: https://sourceware.org/PR34313 Reviewed-by: Paul Eggert (cherry picked from commit f750ffab2f76ae10575cde110b4069ae7009667f) --- include/fcntl.h | 6 ++---- io/bits/fcntl2.h | 12 ++++-------- io/fcntl.h | 8 +++----- sysdeps/unix/sysv/linux/bits/fcntl-linux-fortify.h | 2 +- sysdeps/unix/sysv/linux/bits/fcntl-linux.h | 2 +- 5 files changed, 11 insertions(+), 19 deletions(-) diff --git a/include/fcntl.h b/include/fcntl.h index be435047bc..86890a5b3d 100644 --- a/include/fcntl.h +++ b/include/fcntl.h @@ -20,11 +20,9 @@ extern int __fcntl (int __fd, int __cmd, ...); libc_hidden_proto (__fcntl) extern int __fcntl64 (int __fd, int __cmd, ...) attribute_hidden; libc_hidden_proto (__fcntl64) -extern int __openat (int __fd, const char *__file, int __oflag, ...) - __nonnull ((2)); +extern int __openat (int __fd, const char *__file, int __oflag, ...); libc_hidden_proto (__openat) -extern int __openat64 (int __fd, const char *__file, int __oflag, ...) - __nonnull ((2)); +extern int __openat64 (int __fd, const char *__file, int __oflag, ...); libc_hidden_proto (__openat64) extern int __open_2 (const char *__path, int __oflag); diff --git a/io/bits/fcntl2.h b/io/bits/fcntl2.h index f076cc3367..074c16b204 100644 --- a/io/bits/fcntl2.h +++ b/io/bits/fcntl2.h @@ -135,18 +135,14 @@ open64 (__fortify_clang_overload_arg (const char *, ,__path), int __oflag, #ifdef __USE_ATFILE # ifndef __USE_FILE_OFFSET64 -extern int __openat_2 (int __fd, const char *__path, int __oflag) - __nonnull ((2)); +extern int __openat_2 (int __fd, const char *__path, int __oflag); extern int __REDIRECT (__openat_alias, (int __fd, const char *__path, - int __oflag, ...), openat) - __nonnull ((2)); + int __oflag, ...), openat); # else extern int __REDIRECT (__openat_2, (int __fd, const char *__path, - int __oflag), __openat64_2) - __nonnull ((2)); + int __oflag), __openat64_2); extern int __REDIRECT (__openat_alias, (int __fd, const char *__path, - int __oflag, ...), openat64) - __nonnull ((2)); + int __oflag, ...), openat64); # endif # ifdef __va_arg_pack_len diff --git a/io/fcntl.h b/io/fcntl.h index d0ad4d6652..3d90cc9adb 100644 --- a/io/fcntl.h +++ b/io/fcntl.h @@ -230,19 +230,17 @@ extern int open64 (const char *__file, int __oflag, ...) __nonnull ((1)); This function is a cancellation point and therefore not marked with __THROW. */ # ifndef __USE_FILE_OFFSET64 -extern int openat (int __fd, const char *__file, int __oflag, ...) - __nonnull ((2)); +extern int openat (int __fd, const char *__file, int __oflag, ...); # else # ifdef __REDIRECT extern int __REDIRECT (openat, (int __fd, const char *__file, int __oflag, - ...), openat64) __nonnull ((2)); + ...), openat64); # else # define openat openat64 # endif # endif # ifdef __USE_LARGEFILE64 -extern int openat64 (int __fd, const char *__file, int __oflag, ...) - __nonnull ((2)); +extern int openat64 (int __fd, const char *__file, int __oflag, ...); # endif #endif diff --git a/sysdeps/unix/sysv/linux/bits/fcntl-linux-fortify.h b/sysdeps/unix/sysv/linux/bits/fcntl-linux-fortify.h index 4c8f3a874e..b12b5b75da 100644 --- a/sysdeps/unix/sysv/linux/bits/fcntl-linux-fortify.h +++ b/sysdeps/unix/sysv/linux/bits/fcntl-linux-fortify.h @@ -25,7 +25,7 @@ extern int __REDIRECT (__openat2_alias, (int __dfd, const char *__filename, const struct open_how *__how, size_t __usize), openat2) - __nonnull ((2, 3)); + __nonnull ((3)); #if !__fortify_use_clang __errordecl (__openat2_invalid_size, diff --git a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h index 587b815124..6aaa6cc4e7 100644 --- a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h +++ b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h @@ -485,7 +485,7 @@ extern int open_by_handle_at (int __mountdirfd, struct file_handle *__handle, extern int openat2 (int __dfd, const char * __filename, const struct open_how * __how, __SIZE_TYPE__ __usize) - __nonnull ((2, 3)); + __nonnull ((3)); #endif /* use GNU */ -- 2.55.0 From c2098ca9d581bd35202f2bb36db9dbf2ae452570 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 14 Sep 2026 17:08:03 -0300 Subject: [PATCH 48/49] resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674] update_from_conf copies the search list into the 256-byte resp->defdname and truncates it when an entry does not fit, then asserts that resolv_conf_matches accepts the result. The truncation check there compared the accumulated size against sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname, and the empty-list case did not account for a first entry that does not fit at all. A long search domain in resolv.conf or LOCALDOMAIN thus aborts any process using the resolver. Check whether the entry fits in the remaining defdname space, matching alloc_buffer_copy_string, and also accept an empty resp->dnsrch when the first entry is too long. Add tests covering both cases through the search and domain directives. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer (cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a) --- resolv/resolv_conf.c | 19 +++++++++------ resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 7 deletions(-) diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c index d33f32ac1a..a688d4223b 100644 --- a/resolv/resolv_conf.c +++ b/resolv/resolv_conf.c @@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp, { if (resp->dnsrch[0] == NULL) { - /* Empty search list. No default domain name. */ - return conf->search_list_size == 0 && resp->defdname[0] == '\0'; + /* Empty search list, or the first entry does not fit in + resp->defdname. No default domain name. */ + return resp->defdname[0] == '\0' + && (conf->search_list_size == 0 + || (strlen (conf->search_list[0]) + 1 + > sizeof (resp->defdname))); } if (resp->dnsrch[0] != resp->defdname) @@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp, } else { - /* resp->dnsrch is truncated if the number of elements - exceeds MAXDNSRCH, or if the combined storage space for - the search list exceeds what can be stored in - resp->defdname. */ - if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch)) + /* resp->dnsrch is truncated if the number of elements exceeds + MAXDNSRCH, or if conf->search_list[i] does not fit in the + remaining space of resp->defdname. */ + if (i == MAXDNSRCH + || (search_list_size + strlen (conf->search_list[i]) + 1 + > sizeof (resp->defdname))) break; /* Otherwise, a mismatch indicates a match failure. */ return false; diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c index 1e4c59dac9..e51a532c7e 100644 --- a/resolv/tst-resolv-res_init-skeleton.c +++ b/resolv/tst-resolv-res_init-skeleton.c @@ -724,6 +724,41 @@ struct test_case test_cases[] = "nameserver 192.0.2.1\n" "; nameserver[0]: [192.0.2.1]:53\n" }, +/* Search list entries which do not fit in the legacy 256-byte + resp->defdname buffer (bug 31026). LONG244 is 244 characters long, + so it does not fit after "example.com\0" (12 bytes). LONG256 is 256 + characters long, so it does not fit even as the first entry. */ +#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +#define LONG244 LBL63 "." LBL63 "." LBL63 "." \ + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" +#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a" + {.name = "search list truncated at long entry after short entry", + .conf = "nameserver 192.0.2.1\n" + "search example.com " LONG244 "\n", + .expected = "search example.com\n" + "; search[0]: example.com\n" + "; search[1]: " LONG244 "\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, + {.name = "search list truncated at long first entry", + .conf = "nameserver 192.0.2.1\n" + "search " LONG256 " example.com\n", + .expected = "; search[0]: " LONG256 "\n" + "; search[1]: example.com\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, + {.name = "long first entry from the domain directive", + .conf = "nameserver 192.0.2.1\n" + "domain " LONG256 "\n", + .expected = "; search[0]: " LONG256 "\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, +#undef LONG256 +#undef LONG244 +#undef LBL63 {.name = "trust-ad flag", .conf = "options trust-ad\n" "nameserver 192.0.2.1\n", -- 2.55.0 From 350c6c11fd9c2438a6cd958ab68c92b1ed995f20 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Fri, 18 Sep 2026 20:02:16 +0800 Subject: [PATCH 49/49] Revert "posix: Add POSIX aliases to some spawn functions" This reverts commit 7594b4e5a75d41e891782aa7e3fb51924f6840cb. The upstream is going to revert this for 2.44 once figuring out how to provide those aliases as real ELF symbols instead (that won't be backported to 2.44 so we don't need to wait). Link: https://inbox.sourceware.org/libc-alpha/20260831161028.3062421-2-adhemerval.zanella@linaro.org/ --- conform/data/spawn.h-data | 4 ---- posix/Makefile | 1 - posix/spawn.h | 20 -------------------- posix/tst-spawn-chdir-posix.c | 2 -- posix/tst-spawn-chdir.c | 19 +++---------------- 5 files changed, 3 insertions(+), 43 deletions(-) delete mode 100644 posix/tst-spawn-chdir-posix.c diff --git a/conform/data/spawn.h-data b/conform/data/spawn.h-data index 1f332324c2..43aa9cb8ae 100644 --- a/conform/data/spawn.h-data +++ b/conform/data/spawn.h-data @@ -29,10 +29,6 @@ function int posix_spawnattr_setpgroup (posix_spawnattr_t*, pid_t) function int posix_spawnattr_setschedparam (posix_spawnattr_t*, const struct sched_param*) function int posix_spawnattr_setschedpolicy (posix_spawnattr_t*, int) function int posix_spawnattr_setsigmask (posix_spawnattr_t*, const sigset_t*) -#if defined XOPEN2K24 || defined POSIX2024 -function int posix_spawn_file_actions_addchdir (posix_spawn_file_actions_t*, const char *) -function int posix_spawn_file_actions_addfchdir (posix_spawn_file_actions_t*, int) -#endif function int posix_spawn_file_actions_addclose (posix_spawn_file_actions_t*, int) function int posix_spawn_file_actions_adddup2 (posix_spawn_file_actions_t*, int, int) function int posix_spawn_file_actions_addopen (posix_spawn_file_actions_t*, int, const char *, int, mode_t) diff --git a/posix/Makefile b/posix/Makefile index 10d70ae0ae..7478cc2174 100644 --- a/posix/Makefile +++ b/posix/Makefile @@ -316,7 +316,6 @@ tests := \ tst-rxspencer-no-utf8 \ tst-sched_getaffinity \ tst-spawn-chdir \ - tst-spawn-chdir-posix \ tst-spawn4 \ tst-spawn5 \ tst-spawn6 \ diff --git a/posix/spawn.h b/posix/spawn.h index 0aabf5ebef..5e68752a66 100644 --- a/posix/spawn.h +++ b/posix/spawn.h @@ -200,26 +200,6 @@ extern int posix_spawn_file_actions_adddup2 (posix_spawn_file_actions_t * int __fd, int __newfd) __THROW __nonnull ((1)); -#ifdef __USE_XOPEN2K24XSI - -/* Add an action changing the directory to PATH during spawn. This - affects the subsequent file actions. - Alias of posix_spawn_file_actions_addchdir_np. */ -extern int __REDIRECT_NTH (posix_spawn_file_actions_addchdir, - (posix_spawn_file_actions_t * __restrict __actions, - const char *__restrict __path), - posix_spawn_file_actions_addchdir_np); - -/* Add an action changing the directory to FD during spawn. This - affects the subsequent file actions. FD is not duplicated and must - be open when the file action is executed. - Alias of posix_spawn_file_actions_addfchdir_np. */ -extern int __REDIRECT_NTH (posix_spawn_file_actions_addfchdir, - (posix_spawn_file_actions_t *, int __fd), - posix_spawn_file_actions_addfchdir_np); - -#endif /* __USE_XOPEN2K24XSI */ - #ifdef __USE_MISC /* Add an action changing the directory to PATH during spawn. This affects the subsequent file actions. */ diff --git a/posix/tst-spawn-chdir-posix.c b/posix/tst-spawn-chdir-posix.c deleted file mode 100644 index 3f8d8952bb..0000000000 --- a/posix/tst-spawn-chdir-posix.c +++ /dev/null @@ -1,2 +0,0 @@ -#define USE_POSIX_ALIASES -#include "tst-spawn-chdir.c" diff --git a/posix/tst-spawn-chdir.c b/posix/tst-spawn-chdir.c index 166f835492..a3478d61f6 100644 --- a/posix/tst-spawn-chdir.c +++ b/posix/tst-spawn-chdir.c @@ -78,25 +78,12 @@ add_chdir (posix_spawn_file_actions_t *actions, const char *path, { TEST_COMPARE (posix_spawn_file_actions_addopen (actions, tmpfd, path, O_DIRECTORY | O_RDONLY, 0), 0); - -#ifdef USE_POSIX_ALIASES - int ret = posix_spawn_file_actions_addfchdir (actions, tmpfd); -#else - int ret = posix_spawn_file_actions_addfchdir_np (actions, tmpfd); -#endif - TEST_COMPARE (ret, 0); - + TEST_COMPARE (posix_spawn_file_actions_addfchdir_np + (actions, tmpfd), 0); TEST_COMPARE (posix_spawn_file_actions_addclose (actions, tmpfd), 0); } else - { -#ifdef USE_POSIX_ALIASES - int ret = posix_spawn_file_actions_addchdir (actions, path); -#else - int ret = posix_spawn_file_actions_addchdir_np (actions, path); -#endif - TEST_COMPARE (ret, 0); - } + TEST_COMPARE (posix_spawn_file_actions_addchdir_np (actions, path), 0); } static int -- 2.55.0