posix: Do not recurse once per pattern component in glob [BZ #34453]
glob splits the pattern at its rightmost slash and calls itself on
the part before it, so a pattern needs one stack frame per directory
component. It also calls itself once per brace expression. Either can
be made as deep as the pattern is long, so glob overflows the stack
before it can answer. The descent is on the pattern alone, so the
leading component, which is what decides whether anything can match at
all, is only reached at the bottom of the recursion:
glob ("__nonexistent__/*/*/.../*/x", 0, NULL, &g)
with a few thousand components crashes with an default stack (usually
8MB on Linux).
Expand the components in a loop instead. glob_dir_pattern collects
what each component has to do into a heap-allocated array, then matches
them from left to right, and glob_brace walks the brace expansions with
an explicit stack. Both arrays are sized from the pattern up front:
there is no more than one step per slash and no more than one brace
level per brace, since each consumes one.
Matching left to right also means a leading directory that does not
exist ends the expansion at the first component rather than after
descending through all of them.
Stack usage no longer depends on the pattern: a pattern with 100000
components now resolves on a 64 KiB thread stack, where before 4096
components overflowed 8 MiB.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
What is left are the name used to stat a component without
metacharacters and the blocks holding the matched names. With those on
the heap the alloca budget can go as well.
Also treat the size overflow as an error. It used to fall through
to malloc with the wrapped size and then copy the full length
into it.
alloca is now used only by the MSDOS and Windows paths, which glibc
does not build, so move its header out of the way as well.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
posix: Use malloc instead of alloca for the glob brace expansion
The last alloca in __glob is the buffer holding one expansion of a
brace expression. As with the directory and user names, the stack it
takes is not bounded by the call itself.
Use malloc unconditionally. __glob no longer uses alloca; glob_in_dir
still does, so the accounting stays for now.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
posix: Move the glob home directory lookups out of __glob
Expanding "~" or "~user" needs a struct scratch_buffer to call
getpwnam_r through, where the code might reserve extra stack in
every glob frame (around 1224 bytes on x86_64). Even though the
lookups only run when the caller passed GLOB_TILDE or
GLOB_TILDE_CHECK.
Move the two lookups into glob_current_home_dir and glob_user_home_dir,
which return the directory as a malloc'ed string. The frame of each
glob call drops to around 184 bytes.
This also fixes a small leak: the ~user path returned GLOB_NOSPACE
without freeing user_name when scratch_buffer_grow failed.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
posix: Use malloc instead of alloca for the glob directory name
Use malloc unconditionally instead. These are one-off allocations
whose cost is dwarfed by the readdir and fnmatch work that follows.
The amount of stack this can take is not bounded by these calls alone,
glob recursively calls itself per pattern component, and each call
starts a fresh alloca budget.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.
elf: Use the effective lazy mode for the deferred IRELATIVE pass
The 63b31c05a8a split relocation processing must agree for the lazy
flag, a mismatch would change the .rel.plt handling.
This is not an issue for any port currently, but on hppa it may return
a different value: if hppa implements IFUNC support, the second pass would
route PLT entries to its empty lazy handler and leave the descriptors
unrelocated, silently.
Make ELF_DYNAMIC_RELOCATE_PASS take lazy as an int lvalue and store the
effective mode back into it, so the DL_RELOC_IRELATIVE call reuses the
same variable instead of a separately threaded copy. The two passes can no
longer disagree about the partitioning. elf_machine_runtime_setup has side
effects, so it must stay a single call.
Checked on x86_64-linux-gnu, and built for all supported architectures.
elf: Honour skip_ifunc for cross-object IFUNC relocations [BZ #34428]
Commit 63b31c05a8a ("elf: Defer all IRELATIVE relocations until after PLT
setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming
the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation
that may run an IFUNC resolver. That only holds for IFUNC symbols defined
in the object being relocated: a reference to an IFUNC in another object is
an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC
nature is only known after symbol resolution inside elf_machine_rel. Those
relocations stay in the regular pass, which no longer propagated
skip_ifunc, so __RTLD_NOIFUNC was ignored for them.
ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so
the resolver was called and the diagnostic emitted:
$ ldd -u /bin/ls
/bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk'
ldd -r with LD_BIND_NOW is affected in the same way.
Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC.
This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading
(it reads as "do not process IFUNC", yet it takes a skip_ifunc
argument). Replace it to:
ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single
ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and
ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three
near-identical variants each.
Checked on x86_64-linux-gnu, and built for all supported architectures.
Commit 89b53077d2a ("nptl: Fix Race conditions in pthread cancellation
[BZ#12683]") added a second copy of the __INTERNAL_SYSCALL_NCS{0-7}
and INTERNAL_SYSCALL_NCS_CALL macros, which had already been defined
earlier in the same file by commit 00baddbb93 ("linux: Add generic
syscall implementation"). Remove the second copy.
Marcus Poller [Mon, 6 Jul 2026 08:37:32 +0000 (10:37 +0200)]
nss: Use reallocarray to prevent integer overflow in getaddrinfo (bug 33977)
replacing realloc by reallocarray introduces a basic overflow check.
(old + count) might still overflow, but since the NSS backend is trusted,
we do not consider this to be a valid case.
Magnus Lindholm [Wed, 5 Aug 2026 21:14:59 +0000 (23:14 +0200)]
string: Speed up strcasecmp test data initialization
The strcasecmp and strncasecmp tests repeatedly initialize large
buffers for many combinations of lengths and alignments. The existing
loops perform a remainder operation and call toupper and tolower for
every element.
Generate at most max_char elements using an additive recurrence and
apply the case conversions while creating this initial pattern. The
recurrence produces the same sequence as the existing multiplication
and remainder expression. Expand the completed pattern using bulk
copies.
This preserves the generated test data and locale-dependent case
conversion while substantially reducing the initialization cost on
slower systems.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Magnus Lindholm [Wed, 5 Aug 2026 21:14:58 +0000 (23:14 +0200)]
string: Speed up strcmp test data initialization
The strcmp and strncmp tests repeatedly initialize large buffers for
many combinations of lengths and alignments. The existing loops
perform a remainder operation and two individual stores for every
element.
Generate at most max_char elements using an additive recurrence. The
recurrence produces the same sequence as the existing multiplication
and remainder expression. Expand this initial pattern using bulk
copies, and then copy the completed first buffer to the second buffer.
This preserves the generated test data while substantially reducing
the initialization cost on slower systems.
The change also applies to the wcscmp and wcsncmp tests, which include
the same test sources.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The librtld.map and librtld.os link recipes use $(gnulib), which on arm
contains libgcc-stubs.a through gnulib-arch. But the archive is only a
prerequisite of lib-noranlib so the rtld link can run before the archive
exists:
ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory
The race seems to predates the parallel subdirectory recursion, which
only made it observable.
Add the order-only dependency in sysdeps/arm/Makefile rather than in
elf/Makefile. Theprerequisite lists expand when the rule is parsed,
and gnulib-arch is only defined once Makerules includes the sysdeps
makefiles.
Verified with a build for arm-linux-gnueabihf. Reviewed-by: Sam James <sam@gentoo.org>
Makefile: Order the top-level stamp files before the subdirectory fan-out
The archive rules in Makerules list every stamp file as a prerequisite,
including the top level's own, and the elf sub-make evaluates them to
build libc_pic.a for the librtld.map link. A sub-make can only create
the stamp files of its own directory, so when the top-level ones do not
exist yet it fails with:
make[2]: *** No rule to make target '.../stamp.os', needed by
'.../libc_pic.a'. Stop.
The serial recursion created them before the subdirectories through the
prerequisite order of subdir_lib; the parallel recursion (commit 7cac99621e96) does not. Add them as prerequisites of the object-building
per-subdirectory targets. Reviewed-by: Sam James <sam@gentoo.org>
Makerules: Make the .dt to .d conversion safe against concurrent sub-makes
The %.d: %.dt rule seds its input into a fixed temporary name, renames
it into place and removes the input. Two makes converting the same
file trip over each other:
mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory
sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory
That happens because the elf rtld-Rules recursion runs a sub-make over
every $(rtld-subdirs) directory, which converts that directory's .dt
files, and the parallel subdirectory recursion (commit 7cac99621e96)
runs it concurrently with those subdirectories' own sub-makes.
Add the PID of the shell to the temporary name and claim the input with
a rename: only the run that wins converts and installs the target. Reviewed-by: Sam James <sam@gentoo.org>
Makefile: Only print the test summary in the second pass of 'make check'
The build-only first pass of the two-pass 'make check' still runs the
static checks (abi, conformtest, installed headers, etc.), and the
top-level tests recipe merged and summarized their results.
An unexpected FAIL there (e.g. check-abi) aborted 'check' before the
second pass ran any built test, and even a clean run printed a misleading
partial summary.
Pass tests-summary=no in the first pass to skip the merge and summary;
the .test-result files persist, so the second pass folds those results
into the one complete summary at the end, restoring the single-pass
reporting behavior. Reviewed-by: Sam James <sam@gentoo.org>
Rudi Heitbaum [Thu, 6 Aug 2026 17:07:56 +0000 (14:07 -0300)]
Makerules: Only install the ABI lib-names header from the top level (BZ 34439)
The $(inst_includedir)/%.h install rules exist only where $(headers) is
non-empty, so in a subdir without headers (e.g. csu) the prerequisite
added on install-others-nosubdir has no rule.
It only worked because .NOTPARALLEL made the top level install the header
first, which the parallel subdir recursion no longer guarantees. Reviewed-by: Sam James <sam@gentoo.org>
Fix gen-as-const-headers races with the parallel subdir recursion (BZ 34438)
The parallel subdirectory recursion (commit 7cac99621e96) only orders
csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges
the Depend files request. A header generated from gen-as-const-headers
is only ordered before the compilations of the subdirectory that
adds the .sym (through before-compile), so a header consumed by a
different subdirectory may not exist yet when its consumer is
compiled.
That is the case for <sigaltstack-offsets.h>: it is generated when
building misc, while its only consumer, ____longjmp_chk.S (x86_64 and
sh), is built in debug. The serial recursion always ran misc before
debug in the sorted order, hiding the missing dependency.
Move the generate the header to 'debug' instead.
The same class of problem exists on Hurd: jmp_buf-ssp.h that is used
by ____longjmp_chk.S in debug, and signal-defines.h that is sued
by debug and setjmp.
Deterministically reproduced with 'make debug/subdir_lib' from a clean
build tree (which orders only csu before debug), and verified with
builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu. Reviewed-by: Sam James <sam@gentoo.org>
Matt Turner [Mon, 3 Aug 2026 23:55:09 +0000 (19:55 -0400)]
alpha: expect test-float32x-float64-div to fail
_Float32x and _Float64 are both binary64 on Alpha, so this narrowing
divide is a plain divide and the hardware alone decides whether to signal
underflow.
IEEE 754 determines tininess after rounding from the result rounded as if
the exponent range were unbounded, while Alpha determines it from the
delivered result. The two differ for a quotient that is tiny but rounds
up to the smallest normal, as in DBL_MIN / (1 + 2^-52) under a rounding
mode that rounds away from zero: the binade below DBL_MIN has a finer
spacing than the subnormals, so the unbounded rounding stays below
DBL_MIN and the result is tiny, but the delivered result is DBL_MIN and
looks normal. Alpha signals no underflow for it.
Nothing in software can correct this. The hardware detects no underflow,
so no software completion trap is taken and the kernel emulation never
runs, and as the operation is not really narrowing there is no wider
intermediate for libm to examine.
Matt Turner [Mon, 3 Aug 2026 23:55:06 +0000 (19:55 -0400)]
alpha: add the denormal trap enable bit to FE_NOMASK_ENV
FE_NOMASK_ENV is the floating-point environment in which no exception is
masked, so it must enable every exception that FE_ALL_EXCEPT covers. On
Alpha that includes the GNU extension FE_DENORMAL, whose SWCR trap enable
bit is IEEE_TRAP_ENABLE_DNO (bit 6).
The constant only set bits 1 through 5 (INV, DZE, OVF, UNF and INE), so
after fesetenv (FE_NOMASK_ENV) a subsequent fegetexcept () returned
0x3e0000 rather than FE_ALL_EXCEPT (0x7e0000), and denormal exceptions
stayed masked. Set bit 6 as well.
The cancellable syscall wrappers end with a tail call to __syscall_cancel,
the wrapper frame is then elided, so when the syscall executes the wrapper
is no longer present on the stack. Tools that unwind from CFI alone, such
as valgrind, perf and sampling profilers, cannot observe it. On gdb, it
only recovers it from DWARF call site information, which reduced-debuginfo
libc builds usually omit.
The behaviour is target dependent: for a shared (PIC) the tail call is
emitted on aarch64, arc, loongarch and riscv. It is not emitted on i386,
x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed
on the stack or fewer argument registers are available, nor on powerpc
and mips, where the TOC/GOT pointer must be restored after the call.
This is why the problem was originally reported as aarch64 specific while
x86_64 was unaffected.
Rather than only inhibiting the tail call [1] (which keeps the wrapper frame
but still leaves the __syscall_cancel and __internal_syscall_cancel
frames), move the cancellation logic back into the wrappers. In the
single-threaded case the syscall is now issued directly from the wrapper;
only the multi-threaded path still calls the out-of-line __syscall_cancel_arch.
Matt Turner [Tue, 4 Aug 2026 01:59:44 +0000 (21:59 -0400)]
stdio-common: avoid repeated regexp matches in tst-printf-format.awk
Whether the value is an infinity, a NaN or zero does not change between
the conversions applied to it, but was determined again for each one.
Determine it where the value is read.
Also look for the '#' flag with index() before matching the expressions
that need it, and test the value first where both have to hold.
For the %f conversion for double, in the C locale, as the median of five
runs:
So this only helps with the regular expression engine that gawk 5.4
brought in; under 5.3.2 it is lost in the noise. Output and exit status
are unchanged for the e, f and g conversions for double under both
gawk versions and both locales.
Matt Turner [Tue, 4 Aug 2026 14:17:20 +0000 (10:17 -0400)]
stdio-common: run AWK in the C locale in the printf format tests
The program under test runs in the C locale, through the test program
prefix, but AWK inherits whatever locale the build was started in. They
agree today only because the locale in use shares its decimal point with
the C locale.
It is also faster. gawk takes a single byte path in its regular
expression engine when MB_CUR_MAX is 1, and the script matches several
expressions against every line. For the %f conversion for double, the
largest of these tests, as the median of five runs:
Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at
1.248s against 0.703s for the same input in the C locale, so these tests
have become more expensive than they used to be.
Matt Turner [Sun, 26 Jul 2026 18:43:11 +0000 (14:43 -0400)]
powerpc: Fix -mlong-double-128 IBM format configure test for Clang
The check for -mlong-double-128 IBM extended format support wrapped its
test code in AC_LANG_PROGRAM, which places the body inside main(). The
body defines a function, so it became a nested function definition -- a
GCC extension that Clang does not implement, making the test fail with
Clang.
Use AC_LANG_SOURCE so the function is defined at file scope, and
regenerate configure.
Matt Turner [Sun, 26 Jul 2026 04:27:37 +0000 (00:27 -0400)]
ldbl-opt: Fix -mlong-double-128 configure test for Clang
The check for -mlong-double-128 support wrapped its test code in
AC_LANG_PROGRAM, which places the body inside main(). The body defines
a function, so it became a nested function definition -- a GCC extension
that Clang does not implement, making the test fail (and thus the whole
build error out) with Clang even though it supports -mlong-double-128.
Use AC_LANG_SOURCE so the function is defined at file scope, matching the
pattern already used by the powerpc64le compiler checks, and regenerate
configure.
Frédéric Bérat [Thu, 28 May 2026 08:36:19 +0000 (10:36 +0200)]
elf: Improve diagnostics for static TLS exhaustion
Improve the error diagnostics printed when static TLS allocation fails
during dlopen.
The CHECK_STATIC_TLS macro is updated to pass the fully resolved sym and
the referencing map over to _dl_allocate_static_tls, modifying its
signature.
When _dl_allocate_static_tls is called, it now attempts to reconstruct
what failed using _dl_exception_create_format. It displays:
* The name of the symbol that triggers this.
* Whether this is due to static TLS space being exhausted, or if the
symbol has previously been used as global-dynamic and is now being
tried to use as initial-exec.
* If the symbol-defining map is different from the referencing map, it
includes its name as well.
* If static TLS is exhausted, includes requested size and available
size.
The change cascades through all architecture variants modifying their
dl-machine calls to CHECK_STATIC_TLS to conform to the new prototype.
hurd: Fix build after the ftw kernel_stat.h inclusion
Commit 6758def7171 changed the generic ftw{64}.c to include
kernel_stat.h, which is Linux specific.
Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0,
since struct stat and struct stat64 never share a layout on Hurd: on
32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat,
and on 64-bit ABIs the two structures still differ in size because
_SPARE_SIZE in bits/stat.h reserves three more ints of spare space in
struct stat than in struct stat64.
This keeps the ftw/ftw64 symbols exactly as before the change, where
the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because
the Hurd bits/typesizes.h does not define it.
Checked with a full build for i686-gnu and x86_64-gnu.
Mark Wielaard [Tue, 14 Jan 2025 00:30:40 +0000 (01:30 +0100)]
rt: skip nanosleep interval and abs test for low precision clocks
If a clock doesn't have enough precision to check the sleep resolution
(quantum.tv_nsec > TEST_NSEC / 10) then record the quantum.tv_nsec,
but skip the interval_test and abs_test for that clock.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Tested-by: Magnus Lindholm <linmag7@gmail.com>
Magnus Lindholm [Mon, 3 Aug 2026 15:51:59 +0000 (17:51 +0200)]
alpha: Fix stack alignment in makecontext
The Alpha ABI requires the stack pointer to be 16-byte aligned.
However, __makecontext did not realign it after reserving space for
arguments. Depending on uc_stack.ss_size, this could leave the stack
only 8-byte aligned.
Round the new stack pointer down to a 16-byte boundary after reserving
the argument area.
This fixes stdlib/tst-makecontext2.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Xi Ruoyao [Wed, 22 Jul 2026 11:26:10 +0000 (19:26 +0800)]
io: fix ftw ABI on MIPS n64
On MIPS n64 off_t is same as off64_t, but struct stat is not same as
struct stat64 (very peculiar but see the "as tempting as it..." comment
in linux/mips/kernel_stat.h). As the ftw/ftw64 callback accepts a
pointer to a function who accepts struct stat/stat64, for MIPS n64 we
must use different implementations for ftw and ftw64.
Thus for testing if ftw64 can be aliased to ftw, we should check
XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T.
This resolves the io/tst-ftw-lnk failure observed on MIPS n64.
math: Fix x86_64 tanh _FloatN aliases binding to the FMA variant [BZ 34465]
The generic implementation emits libm_alias_double unconditionally, so
tanhf32x and tanhf64 bind directly to __tanh_fma.
Guard the alias with '#ifndef __tanh' and emit it from the dispatcher,
as sin. Also remove the stale __expm1 defines, unused since tanh moved
to CORE-MATH.
Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'.
Reported-by: Michael Brunnbauer <brunni@netestate.de>
dlfcn: Deprecate dlinfo request type RTLD_DI_ORIGIN (bug #24298)
Commit b52619f2e8bbae57d79c95538346198c4a9f24a6 added a new dlinfo
request type, RTLD_DI_ORIGIN_PATH, to be used instead of RTLD_DI_ORIGIN
which is prone to buffer overflows. With a replacement available,
RTLD_DI_ORIGIN can now be deprecated.
This commit deprecates RTLD_DI_ORIGIN by adding a compile-time warning
upon its use, and documents the deprecation in the manual.
The warning depends on "Enumerator Attributes" supported by gcc
since 6.1 and by clang. A new macro __attribute_deprecated_enum__,
analogous to __attribute_deprecated_msg__, is defined in cdefs.h.
Because gnulib can override system-installed cdefs.h, thus hiding our
definition, the deprecation is conditional on the macro being defined.
benchtests: Create objdir in the bench-%.c generation rule
The $(objpfx)bench-%.c rule writes its output into $(objpfx) without
ensuring that directory exists. Serial builds happened to satisfy
that ordering, with parallel builds the generation recipe can
run before the directory is created, failing with:
Xi Ruoyao [Sat, 25 Jul 2026 16:11:44 +0000 (00:11 +0800)]
elf: test: handle different rootsbindir in tst-ldconfig-cache
When compiling a glibc for a merged-/usr distro people may set
rootsbindir=/usr/sbin. But tst-ldconfig-cache has hard-coded
/sbin/ldconfig path and so it fails with a different rootsbindir.
Fix it by using support_install_rootsbindir like run_ldconfig in
test-container.c.
Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Florian Weimer <fweimer@redhat.com>
localedata: Add brh_PK locale for Brahui language [BZ #33952]
Add locale data for Brahui (brh), a Dravidian language spoken by
approximately 2.8 million people (2023 Pakistan Census) primarily in
Balochistan, Pakistan. Brahui is the only Dravidian language written
in the Perso-Arabic (Nastaliq) script.
The ISO 639-3 code brh is added to iso-639.def. Brahui has no ISO
639-1 or ISO 639-2 code, so the three-letter code is used for both the
terminology and bibliographic fields, as is already done for other
639-3-only entries such as brx (Bodo).
Locale content follows CLDR locale brh, for which the submitter is the
contributing native speaker.
Changes since v3:
- iso-639.def: place Brahui before Braj, restoring alphabetical
order by English language name.
- LC_TIME: add first_weekday 1 and first_workday 2. The previous
value of 7 selected Saturday, which does not match CLDR territory
data for PK (firstDay = sun); ur_PK and sd_PK both use 1.
- LC_TIME: reorder d_t_fmt and date_fmt so the date precedes the
time, matching the CLDR brh date-time combination pattern and the
shape used by sd_PK, and use U+060C ARABIC COMMA as the separator,
which is the comma in the CLDR brh punctuation exemplar set.
- LC_TIME: abday repeats the full day names, as Brahui has no
distinct abbreviated forms; CLDR brh gives identical values at the
abbreviated and wide widths, and ur_PK, pa_PK and fa_IR do the
same.
- LC_TIME: am_pm now matches the CLDR brh day-period values.
- LC_MONETARY: n_sep_by_space 1, matching p_sep_by_space, so that
positive and negative amounts are spaced alike.
- LC_MESSAGES: yesexpr accepts U+062C and U+0647, and noexpr accepts
U+0627, since these initials occur in attested spellings of the
affirmative and negative words.
- LC_CTYPE: add transliterations for U+06C1 and U+06B7.
- LC_TELEPHONE: use the "+%c %a %l" form.
- LC_IDENTIFICATION: record CLDR as the source; bump revision.
Signed-off-by: Hammad Mengal <hammadalo99@gmail.com> Reviewed-by: Mike FABIAN <mfabian@redhat.com>
math: Fix sinh worst-case results for |x| > 36.736801 [BZ 34441]
The CORE-MATH import mistranslated the accurate path result scaling
'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed68), and two of
the 51 exceptional-case table entries were dropped when the table was
moved to e_sinh_data.c (commit f05c4907a27).
Checked on x86_64-linux-gnu and aarch64-linux-gnu.
Remove the glibc.cpu.name tunable since it's unused and out of date.
Add support for glibc.cpu.hwcaps to adjust ifunc selection for debugging
and benchmarking. Only allow disabling of features that are (a) used by
ifuncs, (b) safe to disable to a more generic ifunc without any security
impact.
Samuel Thibault [Wed, 22 Jul 2026 20:24:29 +0000 (22:24 +0200)]
hurd: Make setitimer clear interval on value being 0
posix says value being 0 means disabling a timer, regardless of the
interval, so we should clear the interval in that case, so a further
setitimer call does not see a non-zero interval.
math: Fix inaccurate sin/cos/tan for large arguments (BZ 34376)
The Payne-Hanek range reducer __branred delivers the reduced argument
as a double-double with only about 93 significant bits. For arguments
extremely close to a multiple of pi/2 the true reduced argument can be
as small as 2^-61, so most of those bits cancel and sin/cos/tan can be
wrong by up to ~143000 ulp. This inaccuracy used to be handled by the
multiple-precision slow paths, which was removed by commit 649095838b8 ("sin/cos slow paths: remove slow paths from huge range
reduction") and commit 476d692e8a8 ("math: Remove slow paths in tan
[BZ #15267]").
Restore the e_rem_pio2.c (removed as unused by commit ca3aac57efa
"Remove unused math files") and use __ieee754_rem_pio2 for
the huge-argument reduction instead of __branred, which is removed.
It also does not depend on precise IEEE double rounding, so the nofma
and vector-width workarounds for branred.c are no longer needed.
The file is restored trimmed to its huge-argument path, the callers
reduce smaller arguments themselves and handle non-finite inputs, so
only 1e8 < |x| < 2^1024 reaches __ieee754_rem_pio2.
Checked on x86_64-linux-gnu, aarch64-linux-gnu, armv7a-linux-gnueabihf,
and i686-linux-gnu.
The tan input list spans the full binary64 range, so a single number mixes
the kernel, and the i__branred reductions in one average. Add two named
workloads that isolate the ends of that spread, so each can be measured
separately:
- workload-fast.wrf: uniform random inputs in [-pi, pi].
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
The sin input list spans the full binary64 range, so a single number mixes
the kernel, the reduce_sincos reduction , and the __branred reduction in
one average. Add three named workloads that isolate the paths __cos
actually dispatches to, so each can be measured separately:
- workload-fast.wrf: uniform random inputs in [-pi, pi].
- workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades.
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
The cos input list spans the full binary64 range, so a single number mixes
the kernel, the reduce_sincos reduction , and the __branred reduction in one
average. Add three named workloads that isolate the paths __cos actually
dispatches to, so each can be measured separately:
- workload-fast.wrf: uniform random inputs in [0, 2*pi].
- workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades.
- workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades.
The existing full-range inputs are replaced as the default workload.
elf: Defer arch PLT IFUNC relocations in the two-phase relocation split
The split introduced by commit 63b31c05a8a does not handle sparc
and (R_SPARC_JMP_IREL) powerpc64 (ELFv1, R_PPC64_JMP_IREL), which
are emited in some constructions. Handle such cases on
elf_dynamic_is_Rel_irelative.
It fixes elf/tst-ifunc-fault-bindnow and elf/tst-ifunc-fault-lazy on
sparc64 (powerpc64 emits R_PPC64_IRELATIVE in both cases,
R_PPC64_JMP_IREL is emitted only when the ifunc is called, not just
referenced).
Checked with the elf tests on qemu sparc64 and powerpc64.
Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
After commit b75ad99d45b, __libc_setup_tls -> _dl_allocate_tls_init copies
the TLS init image with the IFUNC __mempcpy before ARCH_SETUP_IREL resolves
it, so on a multi-arch sparcv9/sparc64 static build the call jumps through an
unrelocated PLT slot and the process dies with SIGILL.
The sparc dl-symbol-redir-ifunc.h only redirected memset. Redirect
memcpy, memmove, mempcpy and __mempcpy to the ultra1 routines as well,
and merge the identical sparc64 and sparc32/sparcv9 copies into a single
sysdeps/sparc file. The redirection is guarded by __sparc_v9__ &&
USE_MULTIARCH so that sparcv8 (leon) and --disable-multi-arch builds,
which have no __*_ultra1 routines, are left untouched.
Checked with elf tests for sparc32 and sparc64 on qemu system.
Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
H.J. Lu [Sat, 4 Jul 2026 00:17:05 +0000 (08:17 +0800)]
thp: Disable THP if THP isn't supported by kernel
Since DL_MAP_DEFAULT_THP_PAGESIZE is defined for x86-64, THP control
is to set to madvise by default. If THP is disabled in x86-64 kernel,
madvise (..., MADV_HUGEPAGE) returns -EINVAL to indicate that THP isn't
supported. Add _dl_thp_madvise to disable THP in this case. This
fixes BZ #34348.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
which is needed for THP PDE tests. Add $(LOAD-THP-ADDRESS-LDFLAGS) to
LDFLAGS-tst-thp-1 and LDFLAGS-tst-thp-1-no-s-code if PIE isn't built
by default so that they are linked with $(LOAD-THP-ADDRESS-LDFLAGS).
This fixes BZ #34314.
posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)
The previous implementation saved a copy of the wordexp_t struct at
entry and blindly restored it on error via (*pwordexp = old_word).
This is incorrect when WRDE_APPEND is set because w_addword may have
called realloc on we_wordv during partial processing before the error
was detected. If realloc relocated the buffer, the saved we_wordv
pointer is dangling; restoring it causes a use-after-free in the
caller (e.g. via wordfree), and the relocated buffer is leaked.
Fix this by duplicating the we_wordv pointer array at entry when
WRDE_APPEND is set, so that all subsequent realloc calls inside
w_addword operate on the copy.
This change also fixes a POSIX conformance issue: if the WRDE_APPEND
flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
not be modified.
Also fix two pre-existing error return paths in the '"' and '\'' cases
that returned directly from w_addword failures instead of going through
do_error, which would leak the saved array (and previously would also
skip the word cleanup).
DJ Delorie [Tue, 30 Jun 2026 21:26:34 +0000 (17:26 -0400)]
ldconfig: add --install option
Add --install option, which copies a pre-built ld.so.cache into place,
honoring the cache and root options and defaults. This gives the user
a canonical "correct" way to install a pre-built cache without risk
of a program trying to load a partially-written file.
Stefan Liebler [Tue, 14 Jul 2026 08:56:49 +0000 (10:56 +0200)]
s390: Use 64bit branch relative on count instruction in strncpy-z900.S [BZ #34398]
At the time the s390-32 strncpy implementation was adjusted for the
s390-64 port, the brct (branch relative on count) instruction was
not adjusted from 32bit to 64bit instruction.
If n contains a value >32bit, the number of 8 byte chunks is computed
with srlg (64bit shift right). The processing of 8 byte chunks is then
processed by looping with brct (32bit branch relative on count) instruction.
This patch just uses the brctg (64bit branch relative on count) instruciton.
Note 1: There is a second loop copying the remaining seven bytes. The usage
of 32bit brct for looping is fine here.
Note 2: If glibc is build with architecture level set >=z13, the z900 variant
of strncpy is not build at all.
Note 3: If glibc is build for <z13, the z900 ifunc variant is only chosen if
not run on >=z13 or if called via __GI_strncpy.
Stefan Liebler [Mon, 13 Jul 2026 08:31:53 +0000 (10:31 +0200)]
Use correct type for glibc.malloc.perturb in tst-tunconf1.c
On s390x the test elf/tunconf1 fails with:
tst-tunconf1.c:41: numeric comparison failure (widths 64 and 32)
left: 180388626436 (0x2a00000004); from: (long)perturb
right: 42 (0x2a); from: 42
According to elf/dl-tunables.list, glibc.malloc.perturb is of type int32_t (4byte)
and not size_t (8byte) which was used for TUNABLE_GET_FULL inside the testcase.
Therefore the correct 32bit value 0x2a=42 is written to the to the wrong place
and leads to the comparison failure.
The printf format specifiers for size_t were also adjusted. Reviewed-by: DJ Delorie <dj@redhat.com>
The unconditional '.NOTPARALLEL' in benchtests/Makefile forced the whole
subdirectory to build serially, even though its only purpose is to keep
the benchmark *runs* from perturbing each other's timing.
Replace it with ordering that serializes only the benchmark runs, and
only when more than one benchmark group will actually run. The combined
'bench' goal builds every benchmark program in parallel (through
bench-build) and then runs the bench-set, bench-func and bench-malloc
groups strictly one after another.
sparc: Fix static (non-PIE) executables when PIE is enabled by default
For the default --enable-default-pie, $(pic-default) adds -DPIC to
CPPFLAGS-.o so. However, -fPIE ($(pie-default)) is only added to
CFLAGS-.o, which does not affect assembler (.S) sources
On SPARC the GOT register setup in SETUP_PIC_REG references
_GLOBAL_OFFSET_TABLE_ through %hi/%lo, and the assembler only rewrite
those into the required PC-relative relocations (R_SPARC_PC22 and
R_SPARC_PC10) when it is in *PIC* mode; otherwise it emits absolute
R_SPARC_HI22/R_SPARC_LO10. With the absolute relocations the
__sparc_get_pc_thunk sequence adds the run-time PC to an already-absolute
GOT address, so the computed GOT register is wrong. In _start this makes
the address of main come out bogus, and __libc_start_main jumps to an
unmapped address.
This removes the requirement of the --disable-default-pie for sparc
to build static binaries correctly.
Checked some tests (mainly the elf/ one) on a sparc64-linux-gnu
qemu system.
manual: Document default AT_SECURE handling for system-wide tunables
A system-wide tunable without an onlysecure/nonsecure/anysecure prefix
defaults to "nonsecure", i.e. it is not applied to AT_SECURE processes.
This is a deliberate, conservative default but was not documented.
elf: Let environment aliases override overridable system-wide tunables
The environment-variable alias loop in __tunables_init skipped every tunable
whose "initialized" flag was set, which was originally meant only to give
the canonical GLIBC_TUNABLES form precedence over the legacy MALLOC_*
aliases.
Now that the cache also sets "initialized", a legacy alias could no longer
override an *overridable* cache default, even though the canonical
GLIBC_TUNABLES form still could.
Track separately the tunables that were set from GLIBC_TUNABLES during this
call and skip only those in the alias loop
elf: Avoid redundant ld.so.cache reload after first load
_dl_check_ldsocache_needs_loading only stored the stat fields it
compares (mtime, ino, size, dev) on the path where a cache was already
loaded. On the very first call CACHE is NULL and the function returned
"needs loading" without recording those fields, leaving
new_cache_file_time zero. The next call then copied that zero value
into cache_file_time and compared it against the freshly stat'd values,
which always differed, forcing a second, unnecessary load (munmap +
mmap + re-parse) of an unchanged cache at every startup.
Record the stat fields as soon as the stat succeeds, before the
CACHE == NULL early return, so the following call has an accurate
baseline and does not spuriously reload.
elf: Verify the tunable cache header signature and version
The tunable header signature and version are written by ldconfig but
never checked them on read, so the version field was inert. Reject
the section unless both match.
elf: Bound the tunable cache string table against the mapping size
_dl_load_cache_tunables bounds each entry's string offsets against
[s_start, start + cache_new->len_strings], but len_strings is an
unvalidated 32-bit field from ld.so.cache and s_start/s_end were int. A
corrupt cache with an oversized len_strings could make s_end exceed the
mapping (or overflow), letting an offset point outside the mmap; the
following strcmp/__strdup would then read unmapped memory.
Compute the offsets as size_t and clamp s_end to cachesize, matching how
the regular library lookup bounds string offsets against the mapping size.
localedata: Use libc-alpha ML as the canonical contact
Replace instances of "bug-glibc@gnu.org", "libc-locales@sourceware.org"
and "bug-glibc-locales@gnu.org" with libc-alpha@sourceware.org as the
single touchpoint for the community.
Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
localedata: Avoid concurrently written locales in gen-locale.sh
There is no cross-directory exclusion of concurrent $(gen-locales)
usage. Parallel localedef calls can clobber locale data as it is
being loaded by tests.
With the separate staging areas, there are no peer directories,
so hard-linking no longer happens. The touch command is therefore
unnecessary.
Commit 7e46c2aae47d3284d4eb0845ddcc3951e987d681 synced the accurate ECN
additions but encoded the trailing bitfield word of struct tcp_info
incorrectly as two uint16_t fields (tcpi_accecn_fail_mode and
tcpi_accecn_opt_seen), omitting tcpi_ecn_mode and tcpi_options2. Restore
the kernel layout:
The overall structure size is unchanged. Also add the TCPI_ECN_MODE_*
and TCP_ACCECN_* value constants for these fields, introduced together
with them by Linux commit 4fa4ac5e5848 (Linux 7.0).
projects / thirdparty / glibc.git / log
