Stefan Liebler [Mon, 4 Apr 2016 10:54:23 +0000 (12:54 +0200)]
S390: Extend structs La_s390_regs / La_s390_retval with vector-registers.
Starting with z13, vector registers can also occur as argument registers.
Thus the passed input/output register structs for
la_s390_[32|64]_gnu_plt[enter|exit] functions should reflect those new
registers. This patch extends these structs La_s390_regs and La_s390_retval
and adjusts _dl_runtime_profile() to handle those fields in case of
running on a z13 machine.
Stefan Liebler [Mon, 4 Apr 2016 10:54:23 +0000 (12:54 +0200)]
S390: Save and restore fprs/vrs while resolving symbols.
On s390, no fpr/vrs were saved while resolving a symbol
via _dl_runtime_resolve/_dl_runtime_profile.
According to the abi, the fpr-arguments are defined as call clobbered.
In leaf-functions, gcc 4.9 and newer can use fprs for saving/restoring gprs
instead of saving them to the stack.
If gcc do this in one of the resolver-functions, then the floating point
arguments of a library-function are invalid for the first library-function-call.
Thus, this patch saves/restores the fprs around the resolving code.
The same could occur for vector registers. Furthermore an ifunc-resolver
could also clobber the vector/floating point argument registers.
Thus this patch provides the further variants _dl_runtime_resolve_vx/
_dl_runtime_profile_vx, which are used if the kernel claims, that
we run on a machine with vector registers.
Furthermore, if _dl_runtime_profile calls _dl_call_pltexit,
the pointers to inregs-/outregs-structs were setup invalid.
Now they point to the correct location in the stack-frame.
Before branching back to the caller, the return values are now
restored instead of containing the return values of the
_dl_call_pltexit() call.
On s390-32, an endless loop occurs if _dl_call_pltexit() should be called.
Now, this code-path branches to this function instead of just after the
preceding basr-instruction.
ChangeLog:
* sysdeps/s390/s390-32/dl-trampoline.S: Include dl-trampoline.h twice
to create a non-vector/vector version for _dl_runtime_resolve and
_dl_runtime_profile. Move implementation to ...
* sysdeps/s390/s390-32/dl-trampoline.h: ... here.
(_dl_runtime_resolve) Save and restore fpr/vrs.
(_dl_runtime_profile) Save and restore vrs and fix some issues
if _dl_call_pltexit is called.
* sysdeps/s390/s390-32/dl-machine.h (elf_machine_runtime_setup):
Choose the correct resolver function if running on a machine with vx.
* sysdeps/s390/s390-64/dl-trampoline.S: Include dl-trampoline.h twice
to create a non-vector/vector version for _dl_runtime_resolve and
_dl_runtime_profile. Move implementation to ...
* sysdeps/s390/s390-64/dl-trampoline.h: ... here.
(_dl_runtime_resolve) Save and restore fpr/vrs.
(_dl_runtime_profile) Save and restore vrs and fix some issues
* sysdeps/s390/s390-64/dl-machine.h: (elf_machine_runtime_setup):
Choose the correct resolver function if running on a machine with vx.
Stefan Liebler [Mon, 4 Apr 2016 10:54:22 +0000 (12:54 +0200)]
S390: configure check for vector instruction support in assembler.
The S390 specific test checks if the assembler has support for the new z13
vector instructions by compiling a vector instruction. The .machine and
.machinemode directives are needed to compile the vector instruction without
-march=z13 option on 31/64 bit.
On success the macro HAVE_S390_VX_ASM_SUPPORT is defined. This macro is used
to determine if the optimized functions can be build without compile errors.
If the used assembler lacks vector support, then a warning is dumped while
configuring and only the common code functions are build.
The z13 instruction support was introduced in
"[Committed] S/390: Add support for IBM z13."
(https://sourceware.org/ml/binutils/2015-01/msg00197.html)
ChangeLog:
* config.h.in (HAVE_S390_VX_ASM_SUPPORT): New macro undefine.
* sysdeps/s390/configure.ac: Add test for S390 vector instruction
assembler support.
* sysdeps/s390/configure: Regenerated.
Stefan Liebler [Mon, 4 Apr 2016 10:54:22 +0000 (12:54 +0200)]
S390: Add new s390 platform.
The new IBM z13 is added to platform string array.
The macro _DL_PLATFORMS_COUNT is incremented to 8,
because it was not incremented by commit
"S/390: Sync AUXV capabilities and archs with kernel".
Stefan Liebler [Mon, 4 Apr 2016 10:54:22 +0000 (12:54 +0200)]
S390: Add hwcaps value for vector facility.
The HWCAP_S390_VX flag in hwcap field of auxiliary vector indicates
if the vector facility is available and the kernel is aware of it.
This can be tested with LD_SHOW_AUXV=1 <prog>.
Currently it does not show te, because it was not incremented
by commit "S/390: Add hwcap value for transactional execution.".
Thus _DL_HWCAP_COUNT is incremented by two.
Florian Weimer [Fri, 25 Mar 2016 10:49:51 +0000 (11:49 +0100)]
resolv: Always set *resplen2 out parameter in send_dg [BZ #19791]
Since commit 44d20bca52ace85850012b0ead37b360e3ecd96e (Implement
second fallback mode for DNS requests), there is a code path which
returns early, before *resplen2 is initialized. This happens if the
name server address is immediately recognized as invalid (because of
lack of protocol support, or if it is a broadcast address such
255.255.255.255, or another invalid address).
If this happens and *resplen2 was non-zero (which is the case if a
previous query resulted in a failure), __libc_res_nquery would reuse
an existing second answer buffer. This answer has been previously
identified as unusable (for example, it could be an NXDOMAIN
response). Due to the presence of a second answer, no name server
switching will occur. The result is a name resolution failure,
although a successful resolution would have been possible if name
servers have been switched and queries had proceeded along the search
path.
The above paragraph still simplifies the situation. Before glibc
2.23, if the second answer needed malloc, the stub resolver would
still attempt to reuse the second answer, but this is not possible
because __libc_res_nsearch has freed it, after the unsuccessful call
to __libc_res_nquerydomain, and set the buffer pointer to NULL. This
eventually leads to an assertion failure in __libc_res_nquery:
/* Make sure both hp and hp2 are defined */
assert((hp != NULL) && (hp2 != NULL));
If assertions are disabled, the consequence is a NULL pointer
dereference on the next line.
Starting with glibc 2.23, as a result of commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca (CVE-2015-7547: getaddrinfo()
stack-based buffer overflow (Bug 18665)), the second answer is always
allocated with malloc. This means that the assertion failure happens
with small responses as well because there is no buffer to reuse, as
soon as there is a name resolution failure which triggers a search for
an answer along the search path.
This commit addresses the issue by ensuring that *resplen2 is
initialized before the send_dg function returns.
This commit also addresses a bug where an invalid second reply is
incorrectly returned as a valid to the caller.
Andreas Schwab [Wed, 18 Nov 2015 14:45:59 +0000 (15:45 +0100)]
Fix resource leak in resolver (bug 19257)
The number of currently defined nameservers is stored in ->nscount,
whereas ->_u._ext.nscount is set by __libc_res_nsend only after local
initializations.
The x86_64 fma4 version of pow fails to disable contraction of
operations other than those explicitly intended to use fma
instructions, so resulting in large ulps errors on processors with
fma4 instructions, as in bug 18104 (165ulp for the test added for that
bug; error originally reported by "blaaa" on #glibc). This patch adds
$(config-cflags-nofma) for e_pow-fma4.c, corresponding to the use for
e_pow.c in sysdeps/ieee754/dbl-64/Makefile.
Hongjiu Zhang [Mon, 7 Mar 2016 01:18:21 +0000 (20:18 -0500)]
sln: use stat64
When using sln on some filesystems which return 64-bit inodes,
the stat call might fail during install like so:
.../elf/sln .../elf/symlink.list
/lib32/libc.so.6: invalid destination: Value too large for defined data type
/lib32/ld-linux.so.2: invalid destination: Value too large for defined data type
Makefile:104: recipe for target 'install-symbolic-link' failed
Switch to using stat64 all the time to avoid this.
Stefan Liebler [Thu, 3 Mar 2016 07:17:09 +0000 (08:17 +0100)]
S390: Do not use direct socket syscalls if build on kernels >= 4.3. [BZ #19682]
Beginning with Linux 4.3, the kernel headers contain direct
system call numbers __NR_socket etc. on s390x. On older kernels,
the socket-multiplexer syscall __NR_socketcall was used.
To enable these new syscalls, the patch
"S390: Call direct system calls for socket operations."
(https://sourceware.org/git/?p=glibc.git;a=commit;h=016495b818cb61df7d0d10e6db54074271b3e3a5)
was applied upstream.
If glibc 2.23 is configured with --enable-kernel=4.3 and newer,
the direct socket syscalls are used.
For older kernels, the socket-multiplexer syscall is used instead.
In glibc 2.22 and earlier, this patch is not applied.
If you build glibc on a kernel < 4.3, the socket-multiplexer
syscall is used. But if you build glibc on kernel >= 4.3, the
direct socket-syscalls are used. If you install this glibc on a
kernel < 4.3, all socket operations will fail.
See "Bug 19682 - s390x: Incorrect syscall definitions cause
breakage with Linux 4.3 headers"
(https://sourceware.org/bugzilla/show_bug.cgi?id=19682)
The configure switch --enable-kernel does not influence this
behaviour on older glibc-releases.
The solution is to remove the direct socket-syscalls in
sysdeps/unix/sysv/linux/s390/s390-64/syscalls.list
(this patch) on older glibc-releases as it was done by the
upstream patch, too. These entries were never used on s390x,
but the c-files in sysdeps/unix/sysv/linux/.
After this removal, the behaviour of the socket functions are
not changed compared to the original glibc release version
and the socket-multiplexer-syscall is always used.
powerpc: Enforce compiler barriers on hardware transactions
Work around a GCC behavior with hardware transactional memory built-ins.
GCC doesn't treat the PowerPC transactional built-ins as compiler
barriers, moving instructions past the transaction boundaries and
altering their atomicity.
* A stack-based buffer overflow was found in libresolv when invoked from
libnss_dns, allowing specially crafted DNS responses to seize control
of execution flow in the DNS client. The buffer overflow occurs in
the functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family. The use of AF_UNSPEC triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of the
buffers used for those queries could result in the response of a query
writing beyond the alloca allocated buffer created by
_nss_dns_gethostbyname4_r. Buffer management is simplified to remove
the overflow. Thanks to the Google Security Team and Red Hat for
reporting the security impact of this issue, and Robert Holiday of
Ciena for reporting the related bug 18665. (CVE-2015-7547)
See also:
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://sourceware.org/ml/libc-alpha/2016-02/msg00418.html
As in bugzilla entry there is overflow in hsearch when looking for prime
number as SIZE_MAX - 1 is divisible by 5. We fix that by rejecting large
inputs before looking for prime.
Aurelien Jarno [Mon, 7 Dec 2015 14:40:01 +0000 (15:40 +0100)]
alpha/hppa: fix libc.abilist sorting wrt fmemopen
Commit fdb7d390 introduced the fmemopen symbol at the wrong location
in alpha/libc.abilist and hppa/libc.abilist. The file needs to keep
sorted, fix that.
Note: this is for 2.22 only, for master the format has been changed in
commit 8c77b6ad.
* sysdeps/unix/sysv/linux/alpha/libc.abilist [GLIBC_2.22]: Move
to keep the file sorted.
* sysdeps/unix/sysv/linux/hppa/libc.abilist [GLIBC_2.22]: Likewise.
Paul Murphy [Thu, 27 Aug 2015 14:48:04 +0000 (09:48 -0500)]
powerpc: Fix usage of elision transient failure adapt param
The skip_lock_out_of_tbegin_retries adaptive parameter was
not being used correctly, nor as described. This prevents
a fallback for all users of the lock if a transient abort
occurs within the accepted number of retries.
[BZ #19174]
* sysdeps/powerpc/nptl/elide.h (__elide_lock): Fix usage of
.skip_lock_out_of_tbegin_retries.
* sysdeps/unix/sysv/linux/powerpc/elision-lock.c
(__lll_lock_elision): Likewise, and respect a value of
try_tbegin <= 0.
H.J. Lu [Sat, 7 Nov 2015 14:32:30 +0000 (06:32 -0800)]
Keep only ELF_RTYPE_CLASS_{PLT|COPY} bits for prelink
prelink runs ld.so with the environment variable LD_TRACE_PRELINKING
set to dump the relocation type class from _dl_debug_bindings. prelink
has the following relocation type classes:
where ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA has a conflict with
RTYPE_CLASS_TLS.
Since prelink only uses ELF_RTYPE_CLASS_PLT and ELF_RTYPE_CLASS_COPY
bits, we should clear the other bits when the DL_DEBUG_PRELINK bit is
set.
[BZ #19178]
* elf/dl-lookup.c (RTYPE_CLASS_VALID): New.
(RTYPE_CLASS_PLT): Likewise.
(RTYPE_CLASS_COPY): Likewise.
(RTYPE_CLASS_TLS): Likewise.
(_dl_debug_bindings): Use RTYPE_CLASS_TLS and RTYPE_CLASS_VALID
to set relocation type class for DL_DEBUG_PRELINK. Keep only
ELF_RTYPE_CLASS_PLT and ELF_RTYPE_CLASS_COPY bits for
DL_DEBUG_PRELINK.
The previous code used to evaluate the preprocessor token is_lock_free to
a variable before starting a transaction. This behavior can cause an
error if another thread got the lock (without using a transaction)
between the evaluation of the token and the beginning of the transaction.
This bug can be triggered with the following order of events:
1. The lock accessed by is_lock_free is free.
2. Thread T1 evaluates is_lock_free and stores into register R1 that the
lock is free.
3. Thread T2 acquires the same lock used in is_lock_free.
4. T1 begins the transaction, creating a memory barrier where is_lock_free
is false, but R1 is true.
5. T1 reads R1 and doesn't abort the transaction.
6. T1 calls ELIDE_UNLOCK, which reads false from is_lock_free and decides
to unlock a lock acquired by T2, leading to undefined behavior.
This patch delays the evaluation of is_lock_free to inside a transaction
by moving this part of the code to the macro ELIDE_LOCK.
[BZ #18743]
* sysdeps/powerpc/nptl/elide.h (__elide_lock): Move most of this
code to...
(ELIDE_LOCK): ...here.
(__get_new_count): New function with part of the code from
__elide_lock that updates the value of adapt_count after a
transaction abort.
(__elided_trylock): Moved this code to...
(ELIDE_TRYLOCK): ...here.
The optimization introduced in commit f13c2a8dff2329c6692a80176262ceaaf8a6f74e, causes regressions in
sorting for languages that have digraphs that change sort order, like
cs_CZ which sorts ch between h and i.
My analysis shows the fast-forwarding optimization in STRCOLL advances
through a digraph while possibly stopping in the middle which results
in a subsequent skipping of the digraph and incorrect sorting. The
optimization is incorrect as implemented and because of that I'm
removing it for 2.23, and I will also commit this fix for 2.22 where
it was originally introduced.
This patch reverts the optimization, introduces a new bug-strcoll2.c
regression test that tests both cs_CZ.UTF-8 and da_DK.ISO-8859-1 and
ensures they sort one digraph each correctly. The optimization can't be
applied without regressing this test.
Checked on x86_64, bug-strcoll2.c fails without this patch and passes
after. This will also get a fix on 2.22 which has the same bug.
Florian Weimer [Thu, 15 Oct 2015 07:23:07 +0000 (09:23 +0200)]
Always enable pointer guard [BZ #18928]
Honoring the LD_POINTER_GUARD environment variable in AT_SECURE mode
has security implications. This commit enables pointer guard
unconditionally, and the environment variable is now ignored.
[BZ #18928]
* sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove
_dl_pointer_guard member.
* elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard
initializer.
(security_init): Always set up pointer guard.
(process_envvars): Do not process LD_POINTER_GUARD.
Fix a regression introduced with commit 0d23a5c1 [Static dlopen
correction fallout fixes] that caused the default library search path to
be ignored for modules loaded with dlopen from static executables.
The fix for BZ #17273 introduced a single byte of memory corruption when
the line is entirely blank. It would walk back past the start of the
buffer if the heap happened to be 0x20 or 0x09 and then write a NUL byte.
buffer = '\n';
end_ptr = buffer;
while (end_ptr[-1] == ' ' || end_ptr[-1] == '\t')
end_ptr--;
*end_ptr = '\0';
Fix that and rework the tests. Adding the testcase for BZ #17273 to the
existing \040 parser does not really make sense as it's unrelated, and
leads to confusing behavior: it implicitly relies on the new entry being
longer than the previous entry (since it just rewinds the FILE*). Split
it out into its own dedicated testcase instead.
Mike Frysinger [Thu, 23 Feb 2006 02:12:28 +0000 (21:12 -0500)]
manual: skip build when perl is unavailable
Do not try to generate the manual when perl is unavailable. This
matches the behavior when makeinfo is unavailable. Otherwise the
install step fails when trying to generate the libm section since
it runs a perl script.
If dlopen fails to load an object that has triggered loading libpthread it
causes ld.so to unload libpthread because its DF_1_NODELETE flags has been
forcefully cleared. The next call to __rtdl_unlock_lock_recursive will crash
since pthread_mutex_unlock no longer exists.
This patch moves l->l_flags_1 &= ~DF_1_NODELETE out of loop through all loaded
libraries and performs the action only on inconsistent one.
[BZ #18778]
* elf/Makefile (tests): Add Add tst-nodelete2.
(modules-names): Add tst-nodelete2mod.
(tst-nodelete2mod.so-no-z-defs): New.
($(objpfx)tst-nodelete2): Likewise.
($(objpfx)tst-nodelete2.out): Likewise.
(LDFLAGS-tst-nodelete2): Likewise.
* elf/dl-close.c (_dl_close_worker): Move DF_1_NODELETE clearing
out of loop through all loaded libraries.
* elf/tst-nodelete2.c: New file.
* elf/tst-nodelete2mod.c: Likewise.
hppa: Fix miscompilation of sched_setaffinity() [BZ #18480]
The attached change fixes the miscompilation of sched_setaffinity() on
hppa. This is an old problem that was fixed on other architectures using
a similar approach to the attached change. See:
https://sourceware.org/ml/libc-hacker/2004-04/msg00016.html
Build tested on trunk. Patch has been applied to debian glibc for some time.
Mike Frysinger [Thu, 6 Aug 2015 06:10:46 +0000 (02:10 -0400)]
microblaze: include unix/sysdep.h
The semi-recent SYSCALL_CANCEL inclusion broke microblaze due to the
sysdep.h header not including the unix/sysdep.h header. Include it
here like all other ports.
Mike Frysinger [Fri, 7 Aug 2015 05:43:08 +0000 (01:43 -0400)]
hppa: _dl_symbol_address: add missing hidden def
Commit 2a6ad8142d14c998e6c5eb51418aac1f598b621e updated the headers and
the common dl-symaddr.c, but missed that hppa has its own dedicated source
file for this func. Update that too to fix build errors due to missing
exports of the symbol.
On arches that set _STACK_GROWS_UP, the stacktop variable is declared
and set, but never actually used. Refactor the code a bit so that the
variable is only declared/set under _STACK_GROWS_DOWN settings.
Kevin F. Quinn [Tue, 9 Sep 2014 21:41:57 +0000 (17:41 -0400)]
disable PIE when checking for PIC default
When the compiler builds PIEs by default, the configure PIC check is
confused into thinking PIC code is default. The end result is that
we end up with only PIC being produced.
Run the configure check with -fno-PIE so that we produce PIC & non-PIC
(PIE) objects like normal.
David Lamparter [Fri, 16 Aug 2013 19:06:34 +0000 (15:06 -0400)]
arm: fix PIC vs SHARED typos
the logic in setjmp/__longjmp incorrectly tie to "PIC" to figure out
whether the code is going into a shared library when it should be using
"SHARED". otherwise, building static PIC code goes wrong.
when glibc runs its tests, it does so by invoking the local library loader.
in Gentoo, we build/run inside of our "sandbox" which itself is linked against
libdl (so that it can load libraries and pull out symbols). the trouble
is that when you upgrade from an older glibc to the new one, often times
internal symbols change name or abi. this is normally OK as you cannot use
libc.so from say version 2.3.6 but libpthread.so from say version 2.5, so
we always say "keep all of the glibc libraries from the same build". but
when glibc runs its tests, it uses dynamic paths to point to its new local
copies of libraries. if the test doesnt use libdl, then glibc doesnt add
its path, and when sandbox triggers the loading of libdl, glibc does so
from the host system system. this gets us into the case of all libraries
are from the locally compiled version of glibc except for libdl.so.
Mike Frysinger [Sat, 4 May 2013 18:07:11 +0000 (14:07 -0400)]
disable ldconfig during install
do not bother running ldconfig on DESTDIR. it wants to write the temp cache
file outside of the chroot. doesnt matter anyways as we wont use the cache
results (portage will rebuild cache), so running ldconfig is simply a waste
of time.
Zack Weinberg [Sat, 1 Aug 2015 18:38:05 +0000 (14:38 -0400)]
Deprecate the use of regexp.h
<regexp.h> (not to be confused with <regex.h>) is an obsolete and
frankly horrible regular expression-matching API. It was part of SVID
but was withdrawn in Issue 5 (for reference, we're on Issue 7 now).
It doesn't do anything you can't do with <regex.h>, and using it
involves defining a bunch of macros before including the header.
Moreover, the code in regexp.h that uses those macros has been buggy
since its creation (in 1996) and no one has noticed, which indicates
to me that there are no users. (Specifically, RETURN() is used in a
whole bunch of cases where it should have been ERROR().)
The header is given a warning and marked deprecated for 2.22.
See:
https://sourceware.org/ml/libc-alpha/2015-07/msg00862.html and
https://sourceware.org/ml/libc-alpha/2015-07/msg00871.html.
Mike Frysinger [Thu, 30 Jul 2015 02:55:43 +0000 (22:55 -0400)]
hppa: fix sysdep.h header setup
The semi-recent SYSCALL_CANCEL inclusion broke hppa due to the sysdep.h
headers not including the unix/sysdep.h headers. Rework the includes so
we match the other ports:
* hppa/sysdep.h:
- Do not include sys/syscall.h as the unix sysdep.h headers do it.
- Do not include config.h as libc-symbols.h does it, and it has no
#ifdef multiple-include protection, and it breaks when some files
do things like #undef __OPTIMIZE__.
* sysdeps/unix/sysv/linux/hppa/sysdep-cancel.h:
- Drop the generic/sysdep.h as the unix sysdep.h headers include it.
* sysdeps/unix/sysv/linux/hppa/sysdep.h:
- Change to the unix & core hppa sysdep header stacks.
- Undef a few defines that the core headers already set up for us.
Mike Frysinger [Thu, 30 Jul 2015 03:01:01 +0000 (23:01 -0400)]
hppa: rewrite INLINE_SYSCALL
The semi-recent SYSCALL_CANCEL macro imposes a slight nuance on the
implementation of INLINE_SYSCALL: the nr argument cannot be expanded
directly but must be passed on to another macro which may expand it.
Most arches don't notice because INLINE_SYSCALL is defined in terms
of INTERNAL_SYSCALL which has the additional layer of expansion, but
on hppa, it was attempting to expand it directly. That causes build
errors like so:
../sysdeps/unix/sysv/linux/sigsuspend.c: In function '__sigsuspend':
../sysdeps/unix/sysv/linux/sigsuspend.c:31:62: error:
implicit declaration of function 'LOAD_ARGS___SYSCALL_NARGS'
../sysdeps/unix/sysv/linux/sigsuspend.c:31:304: error:
called object 'LOAD_ARGS___SYSCALL_NARGS(set, 8)' is not a function
So rewrite hppa's INLINE_SYSCALL to use INTERNAL_SYSCALL like other
arches do. This is also a nice clean up as the two macros had quite
a bit of duplicated logic.
H.J. Lu [Wed, 29 Jul 2015 18:57:54 +0000 (11:57 -0700)]
Extend local PLT reference check
On x86, linker in binutils 2.26 and newer consolidates R_*_JUMP_SLOT with
R_*_GLOB_DAT relocation against the same symbol. This patch extends
local PLT reference check to support alternate relocations.
[BZ #18078]
* scripts/check-localplt.awk: Support alternate relocations.
* scripts/localplt.awk: Also check relocations in DT_RELA/DT_REL
sections.
* sysdeps/unix/sysv/linux/i386/localplt.data: Mark free and
malloc entries with + REL R_386_GLOB_DAT.
* sysdeps/x86_64/localplt.data: New file.
Way back in 2005 the atomic_exchange_and_add function was cleaned up to
avoid the explicit size checking and instead let gcc handle things itself.
Unfortunately that change ended up leaving beyond a cast to int, even when
the incoming value was a long. This has flown under the radar for a long
time due to the function not being heavily used in the tree (especially as
a full 64bit field), but a recent change to semaphores made some nptl tests
fail reliably. This is due to the code packing two 32bit values into one
64bit variable (where the high 32bits contained the number of waiters), and
then the whole variable being atomically updated between threads. On ia64,
that meant we never atomically updated the count, so sometimes the sem_post
would not wake up the waiters.
Mike Frysinger [Tue, 28 Jul 2015 04:15:18 +0000 (00:15 -0400)]
ia64: clean up old kernel headers cruft
This define made more sense in the pre-sanitized kernel headers days,
but since we require kernel versions that are sanitized, we don't need
this hack anymore.
Mike Frysinger [Tue, 28 Jul 2015 03:43:09 +0000 (23:43 -0400)]
pwd.h: revert __nonnull markings on putpwent [BZ #18641]
This function actually checks for NULL arguments and the API has been
tenatively documented as using EINVAL in that case. We can debate
leaving it this way, but it should be done after the pending release.
Joseph Myers [Mon, 27 Jul 2015 23:59:08 +0000 (23:59 +0000)]
Mark bug 2981 (elf/tst-audit* fail on MIPS) as fixed.
Changes in support of -fno-plt also cause the elf/tst-audit* tests to
start passing on MIPS. This patch duly marks the relevant bug as
fixed in ChangeLog and NEWS.
Use IE model for static variables in libc.so, libpthread.so and rtld
The recently introduced TLS variables in the thread-local destructor
implementation (__cxa_thread_atexit_impl) used the default GD access
model, resulting in a call to __tls_get_addr. This causes a deadlock
with recent changes to the way TLS is initialized because DTV
allocations are delayed and hence despite knowing the offset to the
variable inside its TLS block, the thread has to take the global rtld
lock to safely update the TLS offset.
This causes deadlocks when a thread is instantiated and joined inside
a destructor of a dlopen'd DSO. The correct long term fix is to
somehow not take the lock, but that will need a lot deeper change set
to alter the way in which the big rtld lock is used.
Instead, this patch just eliminates the call to __tls_get_addr for the
thread-local variables inside libc.so, libpthread.so and rtld by
building all of their units with -mtls-model=initial-exec.
There were concerns that the static storage for TLS is limited and
hence we should not be using it. Additionally, dynamically loaded
modules may result in libc.so looking for this static storage pretty
late in static binaries. Both concerns are valid when using TLSDESC
since that is where one may attempt to allocate a TLS block from
static storage for even those variables that are not IE. They're not
very strong arguments for the traditional TLS model though, since it
assumes that the static storage would be used sparingly and definitely
not by default. Hence, for now this would only theoretically affect
ARM architectures.
The impact is hence limited to statically linked binaries that dlopen
modules that in turn load libc.so, all that on arm hardware. It seems
like a small enough impact to justify fixing the larger problem that
currently affects everything everywhere.
This still does not solve the original problem completely. That is,
it is still possible to deadlock on the big rtld lock with a small
tweak to the test case attached to this patch. That problem is
however not a regression in 2.22 and hence could be tackled as a
separate project. The test case is picked up as is from Alex's patch.
This change has been tested to verify that it does not cause any
issues on x86_64.
ChangeLog:
[BZ #18457]
* nptl/Makefile (tests): New test case tst-join7.
(modules-names): New test case module tst-join7mod.
* nptl/tst-join7.c: New file.
* nptl/tst-join7mod.c: New file.
* Makeconfig (tls-model): Pass -ftls-model=initial-exec for
all translation units in libc.so, libpthread.so and rtld.
Szabolcs Nagy [Fri, 24 Jul 2015 09:05:07 +0000 (10:05 +0100)]
[ARM][BZ #17711] Fix extern protected data handling
Fixes elf/tst-protected1a and elf/tst-protected1b tests.
Depends on a gcc patch that makes protected visibility data non-local:
https://gcc.gnu.org/ml/gcc-patches/2015-07/msg01871.html
and on a binutils patch so R_*_GLOB_DAT relocs are used for it:
https://sourceware.org/ml/binutils/2015-07/msg00247.html
Szabolcs Nagy [Fri, 24 Jul 2015 08:57:32 +0000 (09:57 +0100)]
[AArch64][BZ #17711] Fix extern protected data handling
Fixes elf/tst-protected1a and elf/tst-protected1b tests.
Depends on a gcc patch that makes protected visibility data non-local:
https://gcc.gnu.org/ml/gcc-patches/2015-07/msg01871.html
and on a binutils patch so R_*_GLOB_DAT relocs are used for it:
https://sourceware.org/ml/binutils/2015-07/msg00246.html
glibc supports the deprecated matherr hook for math error reporting. The
conform tests take this into consideration and whitelist this symbol when
running linknamespace tests.
The ia64 libm code has long provided two additional hooks in this space:
matherrf (for floats)
matherrl (for long doubles)
Which causes the conform tests to fail with chains that all look like:
[initial] __atan2 ->
[libm.a(e_atan2.o)] __libm_error_support ->
[libm.a(libm_error.o)] matherrf
We can't (losslessly) redirect existing usage of these funcs to matherr
because the structure passed in is different -- matherr uses a struct with
doubles while matherrf/matherrl use floats and long doubles respectively.
Plus, this has been part of the exported ABI since glibc-2.2.3, so it
doesn't feel right to change it so late.
Until we get around to obsoleting matherr entirely, whitelist these two
additional ia64 symbols.
Also use l_tls_dtor_count to decide on object unload (BZ #18657)
When an TLS destructor is registered, we set the DF_1_NODELETE flag to
signal that the object should not be destroyed. We then clear the
DF_1_NODELETE flag when all destructors are called, which is wrong -
the flag could have been set by other means too.
This patch replaces this use of the flag by using l_tls_dtor_count
directly to determine whether it is safe to unload the object. This
change has the added advantage of eliminating the lock taking when
calling the destructors, which could result in a deadlock. The patch
also fixes the test case tst-tls-atexit - it was making an invalid
dlclose call, which would just return an error silently.
I have also added a detailed note on concurrency which also aims to
justify why I chose the semantics I chose for accesses to
l_tls_dtor_count. Thanks to Torvald for his help in getting me
started on this and (literally) teaching my how to approach the
problem.
Change verified on x86_64; the test suite does not show any
regressions due to the patch.
ChangeLog:
[BZ #18657]
* elf/dl-close.c (_dl_close_worker): Don't unload DSO if there
are pending TLS destructor calls.
* include/link.h (struct link_map): Add concurrency note for
L_TLS_DTOR_COUNT.
* stdlib/cxa_thread_atexit_impl.c (__cxa_thread_atexit_impl):
Don't touch the link map flag. Atomically increment
l_tls_dtor_count.
(__call_tls_dtors): Atomically decrement l_tls_dtor_count.
Avoid taking the load lock and don't touch the link map flag.
* stdlib/tst-tls-atexit-nodelete.c: New test case.
* stdlib/Makefile (tests): Use it.
* stdlib/tst-tls-atexit.c (do_test): dlopen
tst-tls-atexit-lib.so again before dlclose. Add conditionals
to allow tst-tls-atexit-nodelete test case to use it.
projects / thirdparty / glibc.git / log
