1151 Commits

Author SHA1 Message Date
Wilco Dijkstra
9da0585852 atomic: Reinstate HAVE_64B_ATOMICS configure check
Reinstate HAVE_64B_ATOMICS configure check that was reverted by commit
7fec8a5de6 due to BZ #33632.  This was
fixed by 3dd2cbfa35 by only allowing
64-bit atomics on sem_t if its type is 8-byte aligned.  Rebase and add
in cleanups in include/atomic.h that were omitted.

Fix an issue with sparcv8-linux-gnu-leon3 forcing -mcpu=v8 for rtld.c which
overrules -mcpu=leon3 and causes __atomic_always_lock_free (4, 0) to
incorrectly return 0 and trigger asserts in atomics.  Remove this as it
seems to be a workaround for an issue in 1997.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2025-12-17 22:57:00 +00:00
Adhemerval Zanella
6b7067460f Handle clang -Wignored-attributes on weak aliases
Clang issues a warning for double alias redirection, indicating that thei
original symbol is used even if a weak definition attempts to override it.

For instance, in the construction:

  int __internal_impl (...) {}
  weak_alias (__internal_impl, external_impl);
  #if SOMETHING
  weak_alias (external_impl, another_external_impl)
  #endif

Clang warns that another_external_impl always resolves to __internal_impl,
even if external_impl is a weak reference. Using the internal symbol for
both aliases resolves this warning.

This issue also occurs with certain libc_hidden_def usage:

  int __internal_impl (...) {}
  weak_alias (__internal_impl, __internal_alias)
  libc_hidden_weak (__internal_alias)

In this case, using a strong_alias is sufficient to avoid the warning
(since the alias is internal, there is no need to use a weak alias).

However, for the constructions like:

  int __internal_impl (...) {}
  weak_alias (__internal_impl, __internal_alias)
  libc_hidden_def (__internal_alias)
  weak_alias (__internal_impl, external_alias)
  libc_hidden_def (external_alias)

Clang warns that the internal external_alias will always resolve to
__GI___internal_impl, even if a weak definition of __GI_internal_impl is
overridden.  For this case, a new macro named static_weak_alias is used
to create a strong alias for SHARED, or a weak_alias otherwise.

With these changes, there is no need to check and enable the
-Wno-ignored-attributes suppression when using clang.

Checked with a build on affected ABIs, and a full check on aarch64,
armhf, i686, and x86_64.

Reviewed-by: Sam James <sam@gentoo.org>
2025-12-09 08:58:10 -03:00
Joseph Myers
e535fb910c Define C23 header version macros
C23 defines library macros __STDC_VERSION_<header>_H__ to indicate
that a header has support for new / changed features from C23.  Now
that all the required library features are implemented in glibc,
define these macros.  I'm not sure this is sufficiently much of a
user-visible feature to be worth a mention in NEWS.

Tested for x86_64.

There are various optional C23 features we don't yet have, of which I
might look at the Annex H ones (floating-point encoding conversion
functions and _Float16 functions) next.

* Optional time bases TIME_MONOTONIC, TIME_ACTIVE, TIME_THREAD_ACTIVE.
  See
  <https://sourceware.org/pipermail/libc-alpha/2023-June/149264.html>
  - we need to review / update that patch.  (I think patch 2/2,
  inventing new names for all the nonstandard CLOCK_* supported by the
  Linux kernel, is rather more dubious.)

* Updating conform/ tests for C23.

* Defining the rounding mode macro FE_TONEARESTFROMZERO for RISC-V (as
  far as I know, the only architecture supported by glibc that has
  hardware support for this rounding mode for binary floating point)
  and supporting it throughout glibc and its tests (especially the
  string/numeric conversions in both directions that explicitly handle
  each possible rounding mode, and various tests that do likewise).

* Annex H floating-point encoding conversion functions.  (It's not
  entirely clear which are optional even given support for Annex H;
  there's some wording applied inconsistently about only being
  required when non-arithmetic interchange formats are supported; see
  the comments I raised on the WG14 reflector on 23 Oct 2025.)

* _Float16 functions (and other header and testcase support for this
  type).

* Decimal floating-point support.

* Fully supporting __int128 and unsigned __int128 as integer types
  wider than intmax_t, as permitted by C23.  Would need doing in
  coordination with GCC, see GCC bug 113887 for more discussion of
  what's involved.
2025-11-27 19:32:49 +00:00
Adhemerval Zanella
5dab2a3195 stdlib: Remove longlong.h
The gmp-arch.h now provides all the required definitions.

Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
2025-11-26 10:10:06 -03:00
Adhemerval Zanella
476e962af7 Add gmp-arch and udiv_qrnnd
To enable “longlong.h” removal, the udiv_qrnnd is moved to a gmp-arch.h
file.  It allows each architecture to implement its own arch-specific
optimizations.  The generic implementation now uses a static inline,
which provides better type checking than the GNU extension to cast the
asm constraint (and it works better with clang).

Most of the architecture uses the generic implementation, which is
expanded from a macro, except for alpha, x86, m68k, sh, and sparc.
I kept that alpha, which uses out-of-the-line implementations and x86,
where there is no easy way to use the div{q} instruction from C code.
For the rest, the compiler generates good enough code.

The hppa also provides arch-specific implementations, but they are not
routed in “longlong.h” and thus never used.

Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
2025-11-25 14:52:15 -03:00
Joseph Myers
cd748a63ab Implement C23 const-preserving standard library macros
C23 makes various standard library functions, that return a pointer
into an input array, into macros that return a pointer to const when
the relevant argument passed to the macro is a pointer to const.  (The
requirement is for macros, with the existing function types applying
when macro expansion is suppressed.  When a null pointer constant is
passed, such as integer 0, that's the same as a pointer to non-const.)

Implement this feature.  This only applies to C, not C++, since such
macros are not an appropriate way of doing this for C++ and all the
affected functions other than bsearch have overloads to implement an
equivalent feature for C++ anyway.  Nothing is done to apply such a
change to any non-C23 functions with the same property of returning a
pointer into an input array.

The feature is also disabled when _LIBC is defined, since there are
various places in glibc that either redefine these identifiers as
macros, or define the functions themselves, and would need changing to
work in the presence of these macro definitions.  A natural question
is whether we should in fact change those places and not disable the
macro definitions for _LIBC.  If so, we'd need a solution for the
places in glibc that define the macro *before* including the relevant
header (in order in effect to disable the header declaration of the
function by renaming that declaration).

One testcase has #undef added to avoid conflicting with this feature
and another has const added; -Wno-discarded-qualifiers is added for
building zic (but could be removed once there's a new upstream tzcode
release that's const-safe with this C23 change and glibc has updated
to code from that new release).  Probably other places in glibc proper
would need const added if we remove the _LIBC conditionals.

Another question would be whether some GCC extension should be added
to support this feature better with macros that only expand each
argument once (as well as reducing duplication of diagnostics for bad
usages such as non-pointer and pointer-to-volatile-qualfied
arguments).

Tested for x86_64.
2025-11-20 19:31:04 +00:00
Justin King
56549264d1 malloc: add free_sized and free_aligned_sized from C23
Signed-off-by: Justin King <jcking@google.com>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2025-11-19 13:47:53 -03:00
Adhemerval Zanella
7fec8a5de6 Revert __HAVE_64B_ATOMICS configure check
The 53807741fb added a configure check
for 64-bit atomic operations that were not previously enabled on some
32-bit ABIs.

However, the NPTL semaphore code casts a sem_t to a new_sem and issues
a 64-bit atomic operation for __HAVE_64B_ATOMICS.  Since sem_t has
32-bit alignment on 32-bit architectures, this prevents the use of
64-bit atomics even if the ABI supports them.

Assume 64-bit atomic support from __WORDSIZE, which maps to how glibc
defines it before the broken change.  Also rename __HAVE_64B_ATOMICS
to USE_64B_ATOMICS to define better the flag meaning.

Checked on x86_64-linux-gnu and i686-linux-gnu.

Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
2025-11-14 14:05:20 -03:00
Florian Weimer
2eff71d289 stdlib: Do not define once_flag, ONCE_FLAG_INIT for C++
The definition of once_flag conflicts with std::once_flag in
if “using namespace std;” is active.

Updates commit a7ddbf456d
("Add once_flag, ONCE_FLAG_INIT and call_once to stdlib.h for C23").

Suggested-by: Jonathan Wakely <jwakely@redhat.com>
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
2025-11-11 18:20:10 +01:00
Adhemerval Zanella
ab1a96c978 stdlib: Remove mp_clz_tab.c
The count_leading_zeros is not used anymore, so there is no need to
provide the table for possible usage.  The hppa already provides
the compat symbol on libgcc-compat.c.

Reviewed-by: Collin Funk <collin.funk1@gmail.com>
2025-11-10 08:57:52 -03:00
Adhemerval Zanella
36b4c553e6 Replace count_leading_zeros with stdc_leading_zeros
Checked on x86_64-linux-gnu and aarch64-linux-gnu.

Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Collin Funk <collin.funk1@gmail.com>
2025-10-29 12:53:55 -03:00
Joseph Myers
096fcdc0a5 Rename uimaxabs to umaxabs (bug 33325)
The C2y function uimaxabs has been renamed to umaxabs.  Implement this
change in glibc, keeping a compat symbol under the old name, copying
the test to test the new name and changing the old test to test the
compat symbol.  Jakub has done the corresponding change to the
built-in function in GCC.

Tested for x86_64 and x86.
2025-10-28 12:15:02 +00:00
Adhemerval Zanella
047b0e08ac Adjust stdint for clang-20
clang 20 adds both __INT64_C and __UINT64_C as builtins, but different
than gcc it does not undef them in its stdint wrapper.

Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2025-10-20 11:33:54 -03:00
Adhemerval Zanella
64a0f4b776 stdlib: Remove -Wmaybe-uninitialized supression on setenv.c
It is not required on current supported gcc.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
2025-10-20 11:33:54 -03:00
Joseph Myers
0807a262de Make <inttypes.h> printf macros narrow arguments (bug 31470)
A late change in C23, the resolution to CD2 comment GB-108, specified
that <inttypes.h> macros such as PRId8 expand to formats such that,
when an argument is passed in the promoted type that isn't
representable in the original type such as int8_t corresponding to the
format, it gets converted to that type before printing.  (Previously,
the proper handling of such arguments was unclear; the case of direct
use of formats such as %hhd was clarified earlier in C23 development,
and had been fixed in glibc in 2006.)  Implement the change to use
formats such as "hhd" for the affected macros, with associated tests.

Tested for x86_64 and x86.
2025-10-20 12:44:40 +00:00
Joseph Myers
ea18d5a4c2 Implement C23 memalignment
Add the C23 memalignment function (query the alignment of a pointer)
to glibc.

Given how simple this operation is, it would make sense for compilers
to inline calls to this function, but I'm treating that as a compiler
matter (compilers should add it as a built-in function) rather than
adding an inline version to glibc headers (although such an inline
version would be reasonable as well).  I've filed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122117 for this feature
in GCC.

Tested for x86_64 and x86.
2025-10-17 16:56:59 +00:00
Joseph Myers
a7ddbf456d Add once_flag, ONCE_FLAG_INIT and call_once to stdlib.h for C23
C23 adds once_flag, ONCE_FLAG_INIT and call_once to stdlib.h (in C11
they were only in threads.h, in C23 they are in both headers; this
change came from N2840).  Implement this change, with a
bits/types/once_flag.h header for the common type and initializer
definitions.

Note that there's an omnibus bug (bug 33001) that covers more than
just these missing definitions.

This doesn't seem a significant enough feature to be worth mentioning
in NEWS.

ISO C is not concerned with whether functions are in libc or
libpthread, but POSIX links this to what header they are declared in,
so functions declared in stdlib.h are supposed to be in libc.
However, the current edition of POSIX is based on C17; hopefully Hurd
glibc will have completed the merge of libpthread into libc (in
particular, moving call_once) well before a future edition of POSIX
based on C23 (or a later version of ISO C) is released.

Tested for x86_64 and x86.
2025-10-01 15:15:15 +00:00
Florian Weimer
855a67c3cc stdlib: Use support_accept_oom in test-bz22786
The realpath call may trigger OOM termination of the test process
under difficult-to-predict circumstances.  (It depends on available
RAM and swap.)  Therefore, instruct the test driver to ignore
an OOM process termination during the realpath call.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2025-09-18 19:11:38 +02:00
Florian Weimer
54bd776f99 Tests: Create files with mode 0666, not 0777 (bug 33171)
Mode 0777 should be used for directories only because it results
in executable entries (after typical umasks are applied).

Reviewed-by: Arjun Shankar <arjun@redhat.com>
2025-09-01 15:12:28 +02:00
Davide Cavalca
d9a348d092 stdlib: resolve a double lock init issue after fork [BZ #32994]
The __abort_fork_reset_child (introduced in
d40ac01cbb) call resets the lock after the
fork. This causes a DRD regression in valgrind
(https://bugs.kde.org/show_bug.cgi?id=503668), as it's effectively a
double initialization, despite it being actually ok in this case. As
suggested in https://sourceware.org/bugzilla/show_bug.cgi?id=32994#c2
we replace it here with a memcpy of another initialized lock instead,
which makes valgrind happy.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
2025-07-31 19:11:08 +02:00
Arjun Shankar
7eed691cc2 stdlib/Makefile: Remove deleted test's libm dependency
tst-qsort5 was deleted in 709fbd3ec3.
Therefore remove its redundant libm dependency.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
2025-07-02 20:48:35 +02:00
Florian Weimer
3a3fb2ed83 Fix error reporting (false negatives) in SGID tests
And simplify the interface of support_capture_subprogram_self_sgid.

Use the existing framework for temporary directories (now with
mode 0700) and directory/file deletion.  Handle all execution
errors within support_capture_subprogram_self_sgid.  In particular,
this includes test failures because the invoked program did not
exit with exit status zero.  Existing tests that expect exit
status 42 are adjusted to use zero instead.

In addition, fix callers not to call exit (0) with test failures
pending (which may mask them, especially when running with --direct).

Fixes commit 35fc356fa3
("elf: Fix subprocess status handling for tst-dlopen-sgid (bug 32987)").

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2025-05-22 14:36:37 +02:00
Lenard Mollenkopf
5b132ec2b7 stdlib: Implement C2Y uabs, ulabs, ullabs and uimaxabs
C2Y adds unsigned versions of the abs functions (see C2Y draft N3467 and
proposal N3349).

Tested for x86_64.

Signed-off-by: Lenard Mollenkopf <glibc@lenardmollenkopf.de>
2025-04-08 12:51:51 +00:00
Adhemerval Zanella
c8e73a1492 stdlib: Fix qsort memory leak if callback throws (BZ 32058)
If the input buffer exceeds the stack auxiliary buffer, qsort will
malloc a temporary one to call mergesort.  Since C++ standard does
allow the callback comparison function to throw [1], the glibc
implementation can potentially leak memory.

The fixes uses a pthread_cleanup_combined_push and
pthread_cleanup_combined_pop, so it can work with and without
exception enables.  The qsort code path that calls malloc now
requires some extra setup and a call to __pthread_cleanup_push
anmd __pthread_cleanup_pop (which should be ok since they just
setup some buffer state).

Checked on x86_64-linux-gnu.

[1] https://timsong-cpp.github.io/cppwp/n4950/alg.c.library#4

Reviewed-by: DJ Delorie <dj@redhat.com>
2025-04-02 18:01:55 +00:00
Adhemerval Zanella
1894e219dc Remove eloop-threshold.h
On both Linux and Hurd the __eloop_threshold() is always a constant
(40 and 32 respectively), so there is no need to always call
__sysconf (_SC_SYMLOOP_MAX) for Linux case (!SYMLOOP_MAX).  To avoid
a name clash with gnulib, rename the new file min-eloop-threshold.h.

Checked on x86_64-linux-gnu and with a build for x86_64-gnu.
Reviewed-by: DJ Delorie <dj@redhat.com>
2025-03-21 15:46:48 -03:00
Florian Weimer
6ef0bd02db posix: Move environ helper variables next to environ definition (bug 32541)
This helps with statically interposing getenv.

Updates commit 7a61e7f557
("stdlib: Make getenv thread-safe in more cases").

Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2025-03-07 21:40:55 +01:00
Wilco Dijkstra
be0cfd848d stdlib: Add single-threaded fast path to rand()
Improve performance of rand() and __random() by adding a single-threaded
fast path.  Bench-random-lock shows about 5x speedup on Neoverse V1.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2025-02-24 14:13:43 +00:00
H.J. Lu
8ab34497de stdlib: Test using setenv with updated environ [BZ #32588]
Add a test for setenv with updated environ.  Verify that BZ #32588 is
fixed.

Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
2025-01-25 07:31:41 +08:00
Florian Weimer
12b4a1fc6e stdlib: Re-implement free (environ) compatibility kludge for setenv
For the originally failing application (userhelper from usermode),
it is not actually necessary to call realloc on the environ
pointer.  Yes, there will be a memory leak because the application
assigns a heap-allocated pointer to environ that it never frees,
but this leak was always there: the old realloc-based setenv had
a hidden internal variable, last_environ, that was used in a similar
way to __environ_array_list.  The application is not impacted by
the leak anyway because the relevant operations do not happen in
a loop.

The change here just uses a separte heap allocation and points
environ to that.  This means that if an application calls
free (environ) and restores the environ pointer to the value
at process start, and does not modify the environment further,
nothing bad happens.

This change should not invalidate any previous testing that went into
the original getenv thread safety change, commit 7a61e7f557
("stdlib: Make getenv thread-safe in more cases").

The new test cases are modeled in part on the env -i use case from
bug 32588 (with !DO_MALLOC && !DO_EARLY_SETENV), and the previous
stdlib/tst-setenv-malloc test.  The DO_MALLOC && !DO_EARLY_SETENV
case in the new test should approximate what userhelper from the
usermode package does.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2025-01-24 22:37:49 +01:00
Florian Weimer
36fcdfbbc5 Revert "stdlib: Support malloc-managed environ arrays for compatibility"
This reverts commit b62759db04.

Reason for revert: Incompatible with “env -i” and coreutils (bug 32588).

Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
2025-01-24 12:25:29 +01:00
Florian Weimer
b62759db04 stdlib: Support malloc-managed environ arrays for compatibility
Some applications set environ to a heap-allocated pointer, call
setenv (expecting it to call realloc), free environ, and then
restore the original environ pointer.  This breaks after
commit 7a61e7f557 ("stdlib: Make
getenv thread-safe in more cases") because after the setenv call,
the environ pointer does not point to the start of a heap allocation.
Instead, setenv creates a separate allocation and changes environ
to point into that.  This means that the free call in the application
results in heap corruption.

The interim approach was more compatible with other libcs because
it does not assume that the incoming environ pointer is allocated
as if by malloc (if it was written by the application).  However,
it seems to be more important to stay compatible with previous
glibc version: assume the incoming pointer is heap allocated,
and preserve this property after setenv calls.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2025-01-23 17:43:15 +01:00
Florian Weimer
1ac28b7818 stdlib: Test for expected sequence of random numbers from rand
As the test comment explains, this test is not quite valid, but
preserving the exact sequences helps distributions to port to
newer glibc versions.  We can remove this test if we ever switch
to a different implementation.

Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
2025-01-20 21:31:59 +01:00
Florian Weimer
33b684e019 stdlib: Fix unintended change to the random_r implementation
Commit d5bceac99d changed the sequence
of random numbers.  This was completely unintended.  The statistical
properties of the new sequences are unclear, so restore the old
behavior.

Fixes commit d5bceac99d ("stdlib:
random_r: fix unaligned access in initstate and initstate_r
[BZ #30584]").

Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
2025-01-20 21:31:55 +01:00
Florian Weimer
abeae3c006 Linux: Fixes for getrandom fork handling
Careful updates of grnd_alloc.len are required to ensure that
after fork, grnd_alloc.states does not contain entries that
are also encountered by __getrandom_reset_state in TCBs.
For the same reason, it is necessary to overwrite the TCB state
pointer with NULL before updating grnd_alloc.states in
__getrandom_vdso_release.

Before this change, different TCBs could share the same getrandom
state after multi-threaded fork.  This would be a critical security
bug (predictable randomness) if not caught during development.

The additional check in stdlib/tst-arc4random-thread makes it more
likely that the test fails due to the bugs mentioned above.

Both __getrandom_reset_state and __getrandom_vdso_release could
put reserved NULL pointers into the states array.  This is also
fixed with this commit.  After these changes, no null pointers were
observed in the states array during testing.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2025-01-16 19:58:09 +01:00
Sam James
6d556522c3 stdlib: fix lint failure
Fixes: d5bceac99d
2025-01-02 17:09:24 +00:00
Sam James
d5bceac99d stdlib: random_r: fix unaligned access in initstate and initstate_r [BZ #30584]
The initstate{,_r} interfaces are documented in BSD as needing an aligned
array of 32-bit values, but neither POSIX nor glibc's own documentation
require it to be aligned. glibc's documentation says it "should" be a power
of 2, but not must.

Use memcpy to read and write to `state` to handle such an unaligned
argument.

Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Reviewed-by: Florian Weimer <fweimer@redhat.com>
2025-01-02 16:47:51 +00:00
Paul Eggert
2642002380 Update copyright dates with scripts/update-copyrights 2025-01-01 11:22:09 -08:00
Adhemerval Zanella
a2b0ff98a0 include/sys/cdefs.h: Add __attribute_optimization_barrier__
Add __attribute_optimization_barrier__ to disable inlining and cloning on a
function.  For Clang, expand it to

__attribute__ ((optnone))

Otherwise, expand it to

__attribute__ ((noinline, clone))

Co-Authored-By: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sam James <sam@gentoo.org>
2024-12-23 06:28:55 +08:00
Aurelien Jarno
6fd215d6ae posix: fix system when a child cannot be created [BZ #32450]
POSIX states that "if a child process cannot be created, or if the
termination status for the command language interpreter cannot be
obtained, system() shall return -1 and set errno to indicate the error."

In the glibc implementation it could happen when posix_spawn fails,
which happens when the underlying fork, vfork, or clone call fails. They
could fail with EAGAIN and ENOMEM.

Resolves: BZ #32450
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2024-12-20 22:57:06 +01:00
H.J. Lu
560cfeb826 tst-atexit-common.c: Mark _exit_with_flush as noreturn
Mark _exit_with_flush as noreturn to silence the Clang error on
tst-atexit-common.c:

In file included from tst-atexit.c:22:
../stdlib/tst-atexit-common.c:113:5: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]
  113 |     case 0:  /* Child.  */
      |     ^
../stdlib/tst-atexit-common.c:113:5: note: insert 'break;' to avoid fall-through
  113 |     case 0:  /* Child.  */
      |     ^
      |     break;
1 error generated.

Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sam James <sam@gentoo.org>
2024-12-18 01:54:26 +08:00
H.J. Lu
07e3eb1774 Use empty initializer to silence GCC 4.9 or older
Use empty initializer to silence GCC 4.9 or older:

getaddrinfo.c: In function ‘gaih_inet’:
getaddrinfo.c:1135:24: error: missing braces around initializer [-Werror=missing-braces]
       / sizeof (struct gaih_typeproto)] = {0};
                        ^

Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sam James <sam@gentoo.org>
2024-12-16 04:06:30 +08:00
H.J. Lu
20f8c5df56 Revert "Add braces in initializers for GCC 4.9 or older"
This reverts commit 8aa2a9e033.

as not all targets need braces.
2024-12-15 18:49:52 +08:00
H.J. Lu
8aa2a9e033 Add braces in initializers for GCC 4.9 or older
Add braces to silence GCC 4.9 or older:

getaddrinfo.c: In function ‘gaih_inet’:
getaddrinfo.c:1135:24: error: missing braces around initializer [-Werror=missing-braces]
       / sizeof (struct gaih_typeproto)] = {0};
                        ^

Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sam James <sam@gentoo.org>
2024-12-14 19:26:45 +08:00
Florian Weimer
4f5704ea34 powerpc: Use correct procedure call standard for getrandom vDSO call (bug 32440)
A plain indirect function call does not work on POWER because
success and failure are signaled through a flag register, and
not via the usual Linux negative return value convention.

This has potential security impact, in two ways: the return value
could be out of bounds (EAGAIN is 11 on powerpc6le), and no
random bytes have been written despite the non-error return value.

Fixes commit 461cab1de7 ("linux: Add
support for getrandom vDSO").

Reported-by: Ján Stanček <jstancek@redhat.com>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2024-12-11 17:49:04 +01:00
H.J. Lu
5df09b4448 math: Exclude internal math symbols for tests [BZ #32414]
Since internal tests don't have access to internal symbols in libm,
exclude them for internal tests.  Also make tst-strtod5 and tst-strtod5i
depend on $(libm) to support older versions of GCC which can't inline
copysign family functions.  This fixes BZ #32414.

Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
2024-12-07 13:43:01 -08:00
Adhemerval Zanella
82a3991a84 Remove nios2-linux-gnu
GCC 15 (e876acab6cdd84bb2b32c98fc69fb0ba29c81153) and binutils
(e7a16d9fd65098045ef5959bf98d990f12314111) both removed all Nios II
support, and the architecture has been EOL'ed by the vendor.  The
kernel still has support, but without a proper compiler there
is no much sense in keep it on glibc.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
2024-11-28 14:03:25 -03:00
Florian Weimer
7a61e7f557 stdlib: Make getenv thread-safe in more cases
Async-signal-safety is preserved, too.  In fact, getenv is fully
reentrant and can be called from the malloc call in setenv
(if a replacement malloc uses getenv during its initialization).

This is relatively easy to implement because even before this change,
setenv, unsetenv, clearenv, putenv do not deallocate the environment
strings themselves as they are removed from the environment.

The main changes are:

* Use release stores for environment array updates, following
  the usual pattern for safely publishing immutable data
  (in this case, the environment strings).

* Do not deallocate the environment array.  Instead, keep older
  versions around and adopt an  exponential resizing policy.  This
  results in an amortized constant space leak per active environment
  variable, but there already is such a leak for the variable itself
  (and that is even length-dependent, and includes no-longer used
  values).

* Add a seqlock-like mechanism to retry getenv if a concurrent
  unsetenv is observed.  Without that, it is possible that
  getenv returns NULL for a variable that is never unset.  This
  is visible on some AArch64 implementations with the newly
  added stdlib/tst-getenv-unsetenv test case.  The mechanism
  is not a pure seqlock because it tolerates one write from
  unsetenv.  This avoids the need for a second copy of the
  environ array that getenv can read from a signal handler
  that happens to interrupt an unsetenv call.

No manual updates are included with this patch because environ
usage with execve, posix_spawn, system is still not thread-safe
relative unsetenv.  The new process may end up with an environment
that misses entries that were never unset.  This is the same issue
described above for getenv.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
2024-11-21 21:10:52 +01:00
Adhemerval Zanella
461cab1de7 linux: Add support for getrandom vDSO
Linux 6.11 has getrandom() in vDSO. It operates on a thread-local opaque
state allocated with mmap using flags specified by the vDSO.

Multiple states are allocated at once, as many as fit into a page, and
these are held in an array of available states to be doled out to each
thread upon first use, and recycled when a thread terminates. As these
states run low, more are allocated.

To make this procedure async-signal-safe, a simple guard is used in the
LSB of the opaque state address, falling back to the syscall if there's
reentrancy contention.

Also, _Fork() is handled by blocking signals on opaque state allocation
(so _Fork() always sees a consistent state even if it interrupts a
getrandom() call) and by iterating over the thread stack cache on
reclaim_stack. Each opaque state will be in the free states list
(grnd_alloc.states) or allocated to a running thread.

The cancellation is handled by always using GRND_NONBLOCK flags while
calling the vDSO, and falling back to the cancellable syscall if the
kernel returns EAGAIN (would block). Since getrandom is not defined by
POSIX and cancellation is supported as an extension, the cancellation is
handled as 'may occur' instead of 'shall occur' [1], meaning that if
vDSO does not block (the expected behavior) getrandom will not act as a
cancellation entrypoint. It avoids a pthread_testcancel call on the fast
path (different than 'shall occur' functions, like sem_wait()).

It is currently enabled for x86_64, which is available in Linux 6.11,
and aarch64, powerpc32, powerpc64, loongarch64, and s390x, which are
available in Linux 6.12.

Link: https://pubs.opengroup.org/onlinepubs/9799919799/nframe.html [1]
Co-developed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Tested-by: Jason A. Donenfeld <Jason@zx2c4.com> # x86_64
Tested-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> # x86_64, aarch64
Tested-by: Xi Ruoyao <xry111@xry111.site> # x86_64, aarch64, loongarch64
Tested-by: Stefan Liebler <stli@linux.ibm.com> # s390x
2024-11-12 14:42:12 -03:00
Adhemerval Zanella
d40ac01cbb stdlib: Make abort/_Exit AS-safe (BZ 26275)
The recursive lock used on abort does not synchronize with a new process
creation (either by fork-like interfaces or posix_spawn ones), nor it
is reinitialized after fork().

Also, the SIGABRT unblock before raise() shows another race condition,
where a fork or posix_spawn() call by another thread, just after the
recursive lock release and before the SIGABRT signal, might create
programs with a non-expected signal mask.  With the default option
(without POSIX_SPAWN_SETSIGDEF), the process can see SIG_DFL for
SIGABRT, where it should be SIG_IGN.

To fix the AS-safe, raise() does not change the process signal mask,
and an AS-safe lock is used if a SIGABRT is installed or the process
is blocked or ignored.  With the signal mask change removal,
there is no need to use a recursive loc.  The lock is also taken on
both _Fork() and posix_spawn(), to avoid the spawn process to see the
abort handler as SIG_DFL.

A read-write lock is used to avoid serialize _Fork and posix_spawn
execution.  Both sigaction (SIGABRT) and abort() requires to lock
as writer (since both change the disposition).

The fallback is also simplified: there is no need to use a loop of
ABORT_INSTRUCTION after _exit() (if the syscall does not terminate the
process, the system is broken).

The proposed fix changes how setjmp works on a SIGABRT handler, where
glibc does not save the signal mask.  So usage like the below will now
always abort.

  static volatile int chk_fail_ok;
  static jmp_buf chk_fail_buf;

  static void
  handler (int sig)
  {
    if (chk_fail_ok)
      {
        chk_fail_ok = 0;
        longjmp (chk_fail_buf, 1);
      }
    else
      _exit (127);
  }
  [...]
  signal (SIGABRT, handler);
  [....]
  chk_fail_ok = 1;
  if (! setjmp (chk_fail_buf))
    {
      // Something that can calls abort, like a failed fortify function.
      chk_fail_ok = 0;
      printf ("FAIL\n");
    }

Such cases will need to use sigsetjmp instead.

The _dl_start_profile calls sigaction through _profil, and to avoid
pulling abort() on loader the call is replaced with __libc_sigaction.

Checked on x86_64-linux-gnu and aarch64-linux-gnu.

Reviewed-by: DJ Delorie <dj@redhat.com>
2024-10-08 14:40:12 -03:00
Joseph Myers
94ca2c0894 Make tst-strtod-underflow type-generic
The test tst-strtod-underflow covers various edge cases close to the
underflow threshold for strtod (especially cases where underflow on
architectures with after-rounding tininess detection depends on the
rounding mode).  Make it use the type-generic machinery, with
corresponding test inputs for each supported floating-point format, so
that other functions in the strtod family are tested for underflow
edge cases as well.

Tested for x86_64.
2024-09-20 23:25:32 +00:00