Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: gl...@packages.debian.org Control: affects -1 + src:glibc User: release.debian....@packages.debian.org Usertags: pu
[ Reason ] The upstream stable branch got a few fixes in the last months, and this update pulls them into the debian package. This includes a security fix that didn't warrant a DSA release. [ Impact ] In case the update isn't approved, systems will be left with a few issues, including a security one, and the differences with upstream will increase. [ Tests ] The upstream fixes come with additional tests, which represent a significant part of the diff. [ Risks ] The changes to do not affect critical part of the library, and come with additional tests. The changes are already in testing/sid for more than a month. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] All the changes come from the upstream stable branch, and are summarized in the debian changelog. Let me comment it: - Change ldconfig auxcache magic number. The ldconfig auxcache format was changed between 2.35 and 2.36, but the magic number was not updated. This doesn't directly affected the debian package because the preinst script wipes this cache on major library upgrades. However it might affect other cases, such as using ldconfig from the host on chroots or containers. - Ensure data passed to the rseq syscall are properly initialized. Some fields of the rseq_area structure in the pthread structure were not properly initialized before calling the rseq syscall. Their initialization depended solely on the initialization of the pthread structure, which is not guaranteed on all architectures - Avoid integer truncation when parsing CPUID data with large cache sizes, fixing a memcpy/memmove when running under the FreeBSD's bhyve hypervisor. The FreeBSD's bhyve on x86 exposes an 1TiB L3 cache size in CPUID, which was not properly handled by glibc code. This is the upstream bug report: https://sourceware.org/bugzilla/show_bug.cgi?id=32470 - Optimize log2/expm1/log1p math functions with FMA. It was found that those functions didn't provide a version compiled with gcc -mfma -mavx2 options, like similar math functions, so this was fixed. - Fix missing cache information when running under Azure TDX hypervisor. This is the upstream bug report: https://sourceware.org/bugzilla/show_bug.cgi?id=30643 - Fix TLS performance degradation after dlopen() usage. After opening a library with dlopen(), calls to __tls_get_addr() takes significantly more time to execute. This affects multiple software like for instance SageMath. Note that the fix required a few follow up fixes. This is the upstream bug report: https://sourceware.org/bugzilla/show_bug.cgi?id=19924 - Fix memset performance for unaligned destinations causing additional loop iterations. The vector memset version had a destination address alignment that was too high, causing additional loop iterations. - Fixes a buffer overflow when printing assertion failure message (GLIBC-SA-2025-0001 / CVE-2025-0395). When the assert() function fails, it does not allocate sufficient space for the assertion failure message string and its size information. This can result in a buffer overflow if the message string size aligns with the page size. Note for the few of the above changes, some test infrastructure changes or makefile line splitting were backported to simplify the backport of the fix and the associated test.
diff --git a/debian/changelog b/debian/changelog index db487cb8..00330d47 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,21 @@ +glibc (2.36-9+deb12u10) UNRELEASED; urgency=medium + + * debian/patches/git-updates.diff: update from upstream stable branch: + - Change ldconfig auxcache magic number. + - Ensure data passed to the rseq syscall are properly initialized. + - Avoid integer truncation when parsing CPUID data with large cache sizes, + fixing a memcpy/memmove when running under the FreeBSD's bhyve + hypervisor. + - Optimize log2/expm1/log1p math functions with FMA. + - Fix missing cache information when running under Azure TDX hypervisor. + - Fix TLS performance degradation after dlopen() usage. + - Fix memset performance for unaligned destinations causing additional + loop iterations. + - Fixes a buffer overflow when printing assertion failure message + (GLIBC-SA-2025-0001 / CVE-2025-0395). + + -- Aurelien Jarno <aure...@debian.org> Mon, 03 Mar 2025 19:21:09 +0100 + glibc (2.36-9+deb12u9) bookworm; urgency=medium * debian/testsuite-xfail-debian.mk: mark tst-support_descriptors as XFAIL, diff --git a/debian/patches/git-updates.diff b/debian/patches/git-updates.diff index e5d246ed..f37bb1ad 100644 --- a/debian/patches/git-updates.diff +++ b/debian/patches/git-updates.diff @@ -85,10 +85,10 @@ index d1e139d03c..09c0cf8357 100644 else # -s verbose := diff --git a/NEWS b/NEWS -index f61e521fc8..3437574218 100644 +index f61e521fc8..96ff2c8a20 100644 --- a/NEWS +++ b/NEWS -@@ -5,6 +5,107 @@ See the end for copying conditions. +@@ -5,6 +5,115 @@ See the end for copying conditions. Please send GNU C library bug reports via <https://sourceware.org/bugzilla/> using `glibc' in the "product" field. @@ -133,6 +133,11 @@ index f61e521fc8..3437574218 100644 + buffer overflow, which could be exploited to achieve escalated + privileges. This flaw was introduced in glibc 2.34. + ++ CVE-2025-0395: When the assert() function fails, it does not allocate ++ enough space for the assertion failure message string and size ++ information, which may lead to a buffer overflow if the message string ++ size aligns to page size. ++ +The following bugs are resolved with this release: + + [12154] Do not fail DNS resolution for CNAMEs which are not host names @@ -192,10 +197,177 @@ index f61e521fc8..3437574218 100644 + [31968] mremap implementation in C does not handle arguments correctly + [32052] Name space violation in fortify wrappers + [32137] libio: Attempt wide backup free only for non-legacy code ++ [32231] elf: Change ldconfig auxcache magic number ++ [32470] x86: Avoid integer truncation with large cache sizes ++ [32582] Fix underallocation of abort_msg_s struct (CVE-2025-0395) + Version 2.36 Major new features: +diff --git a/assert/Makefile b/assert/Makefile +index f7cf8e9b77..df5a8e6f10 100644 +--- a/assert/Makefile ++++ b/assert/Makefile +@@ -22,10 +22,23 @@ subdir := assert + + include ../Makeconfig + +-headers := assert.h +- +-routines := assert assert-perr __assert +-tests := test-assert test-assert-perr tst-assert-c++ tst-assert-g++ ++headers := \ ++ assert.h ++ # headers ++ ++routines := \ ++ __assert \ ++ assert \ ++ assert-perr \ ++ # routines ++ ++tests := \ ++ test-assert \ ++ test-assert-perr \ ++ tst-assert-c++ \ ++ tst-assert-g++ \ ++ tst-assert-sa-2025-0001 \ ++ # tests + + ifeq ($(have-cxx-thread_local),yes) + CFLAGS-tst-assert-c++.o = -std=c++11 +@@ -33,7 +46,10 @@ LDLIBS-tst-assert-c++ = -lstdc++ + CFLAGS-tst-assert-g++.o = -std=gnu++11 + LDLIBS-tst-assert-g++ = -lstdc++ + else +-tests-unsupported += tst-assert-c++ tst-assert-g++ ++tests-unsupported += \ ++ tst-assert-c++ \ ++ tst-assert-g++ \ ++ # tests-unsupported + endif + + include ../Rules +diff --git a/assert/assert.c b/assert/assert.c +index 133a183bc3..9e55eeb473 100644 +--- a/assert/assert.c ++++ b/assert/assert.c +@@ -18,6 +18,7 @@ + #include <assert.h> + #include <atomic.h> + #include <ldsodefs.h> ++#include <libc-pointer-arith.h> + #include <libintl.h> + #include <stdio.h> + #include <stdlib.h> +@@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file, + (void) __fxprintf (NULL, "%s", str); + (void) fflush (stderr); + +- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); ++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, ++ GLRO(dl_pagesize)); + struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, + MAP_ANON | MAP_PRIVATE, -1, 0); + if (__glibc_likely (buf != MAP_FAILED)) +diff --git a/assert/tst-assert-sa-2025-0001.c b/assert/tst-assert-sa-2025-0001.c +new file mode 100644 +index 0000000000..102cb0078d +--- /dev/null ++++ b/assert/tst-assert-sa-2025-0001.c +@@ -0,0 +1,92 @@ ++/* Test for CVE-2025-0395. ++ Copyright The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++/* Test that a large enough __progname does not result in a buffer overflow ++ when printing an assertion failure. This was CVE-2025-0395. */ ++#include <assert.h> ++#include <inttypes.h> ++#include <signal.h> ++#include <stdbool.h> ++#include <string.h> ++#include <sys/mman.h> ++#include <support/check.h> ++#include <support/support.h> ++#include <support/xstdio.h> ++#include <support/xunistd.h> ++ ++extern const char *__progname; ++ ++int ++do_test (int argc, char **argv) ++{ ++ ++ support_need_proc ("Reads /proc/self/maps to add guards to writable maps."); ++ ignore_stderr (); ++ ++ /* XXX assumes that the assert is on a 2 digit line number. */ ++ const char *prompt = ": %s:99: do_test: Assertion `argc < 1' failed.\n"; ++ ++ int ret = fprintf (stderr, prompt, __FILE__); ++ if (ret < 0) ++ FAIL_EXIT1 ("fprintf failed: %m\n"); ++ ++ size_t pagesize = getpagesize (); ++ size_t namesize = pagesize - 1 - ret; ++ ++ /* Alter the progname so that the assert message fills the entire page. */ ++ char progname[namesize]; ++ memset (progname, 'A', namesize - 1); ++ progname[namesize - 1] = '\0'; ++ __progname = progname; ++ ++ FILE *f = xfopen ("/proc/self/maps", "r"); ++ char *line = NULL; ++ size_t len = 0; ++ uintptr_t prev_to = 0; ++ ++ /* Pad the beginning of every writable mapping with a PROT_NONE map. This ++ ensures that the mmap in the assert_fail path never ends up below a ++ writable map and will terminate immediately in case of a buffer ++ overflow. */ ++ while (xgetline (&line, &len, f)) ++ { ++ uintptr_t from, to; ++ char perm[4]; ++ ++ sscanf (line, "%" SCNxPTR "-%" SCNxPTR " %c%c%c%c ", ++ &from, &to, ++ &perm[0], &perm[1], &perm[2], &perm[3]); ++ ++ bool writable = (memchr (perm, 'w', 4) != NULL); ++ ++ if (prev_to != 0 && from - prev_to > pagesize && writable) ++ xmmap ((void *) from - pagesize, pagesize, PROT_NONE, ++ MAP_ANONYMOUS | MAP_PRIVATE, 0); ++ ++ prev_to = to; ++ } ++ ++ xfclose (f); ++ ++ assert (argc < 1); ++ return 0; ++} ++ ++#define EXPECTED_SIGNAL SIGABRT ++#define TEST_FUNCTION_ARGV do_test ++#include <support/test-driver.c> diff --git a/bits/socket.h b/bits/socket.h index 2b99dea33b..aac8c49b00 100644 --- a/bits/socket.h @@ -358,7 +530,7 @@ index 2696dde4b1..9b07b4e132 100644 void * diff --git a/elf/Makefile b/elf/Makefile -index fd77d0c7c8..cea9c1b29d 100644 +index fd77d0c7c8..eb77ff641d 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -53,6 +53,7 @@ routines = \ @@ -394,7 +566,15 @@ index fd77d0c7c8..cea9c1b29d 100644 tst-dlopenfail \ tst-dlopenfail-2 \ tst-dlopenrpath \ -@@ -631,6 +636,7 @@ ifeq ($(run-built-tests),yes) +@@ -435,6 +440,7 @@ tests += \ + tst-p_align1 \ + tst-p_align2 \ + tst-p_align3 \ ++ tst-recursive-tls \ + tst-relsort1 \ + tst-ro-dynamic \ + tst-rtld-run-static \ +@@ -631,6 +637,7 @@ ifeq ($(run-built-tests),yes) tests-special += \ $(objpfx)noload-mem.out \ $(objpfx)tst-ldconfig-X.out \ @@ -402,7 +582,7 @@ index fd77d0c7c8..cea9c1b29d 100644 $(objpfx)tst-leaks1-mem.out \ $(objpfx)tst-rtld-help.out \ # tests-special -@@ -765,6 +771,8 @@ modules-names += \ +@@ -765,6 +772,8 @@ modules-names += \ tst-alignmod3 \ tst-array2dep \ tst-array5dep \ @@ -411,7 +591,7 @@ index fd77d0c7c8..cea9c1b29d 100644 tst-audit11mod1 \ tst-audit11mod2 \ tst-audit12mod1 \ -@@ -798,6 +806,7 @@ modules-names += \ +@@ -798,6 +807,7 @@ modules-names += \ tst-auditmanymod7 \ tst-auditmanymod8 \ tst-auditmanymod9 \ @@ -419,7 +599,7 @@ index fd77d0c7c8..cea9c1b29d 100644 tst-auditmod1 \ tst-auditmod9a \ tst-auditmod9b \ -@@ -834,6 +843,8 @@ modules-names += \ +@@ -834,6 +844,8 @@ modules-names += \ tst-dlmopen1mod \ tst-dlmopen-dlerror-mod \ tst-dlmopen-gethostbyname-mod \ @@ -428,7 +608,31 @@ index fd77d0c7c8..cea9c1b29d 100644 tst-dlopenfaillinkmod \ tst-dlopenfailmod1 \ tst-dlopenfailmod2 \ -@@ -990,23 +1001,8 @@ modules-names += tst-gnu2-tls1mod +@@ -866,6 +878,23 @@ modules-names += \ + tst-null-argv-lib \ + tst-p_alignmod-base \ + tst-p_alignmod3 \ ++ tst-recursive-tlsmallocmod \ ++ tst-recursive-tlsmod0 \ ++ tst-recursive-tlsmod1 \ ++ tst-recursive-tlsmod2 \ ++ tst-recursive-tlsmod3 \ ++ tst-recursive-tlsmod4 \ ++ tst-recursive-tlsmod5 \ ++ tst-recursive-tlsmod6 \ ++ tst-recursive-tlsmod7 \ ++ tst-recursive-tlsmod8 \ ++ tst-recursive-tlsmod9 \ ++ tst-recursive-tlsmod10 \ ++ tst-recursive-tlsmod11 \ ++ tst-recursive-tlsmod12 \ ++ tst-recursive-tlsmod13 \ ++ tst-recursive-tlsmod14 \ ++ tst-recursive-tlsmod15 \ + tst-relsort1mod1 \ + tst-relsort1mod2 \ + tst-ro-dynamic-mod \ +@@ -990,23 +1019,8 @@ modules-names += tst-gnu2-tls1mod $(objpfx)tst-gnu2-tls1: $(objpfx)tst-gnu2-tls1mod.so tst-gnu2-tls1mod.so-no-z-defs = yes CFLAGS-tst-gnu2-tls1mod.c += -mtls-dialect=gnu2 @@ -453,7 +657,7 @@ index fd77d0c7c8..cea9c1b29d 100644 ifeq (yes,$(have-protected-data)) modules-names += tst-protected1moda tst-protected1modb tests += tst-protected1a tst-protected1b -@@ -2410,6 +2406,11 @@ $(objpfx)tst-ldconfig-X.out : tst-ldconfig-X.sh $(objpfx)ldconfig +@@ -2410,6 +2424,11 @@ $(objpfx)tst-ldconfig-X.out : tst-ldconfig-X.sh $(objpfx)ldconfig '$(run-program-env)' > $@; \ $(evaluate-test) @@ -465,7 +669,7 @@ index fd77d0c7c8..cea9c1b29d 100644 # Test static linking of all the libraries we can possibly link # together. Note that in some configurations this may be less than the # complete list of libraries we build but we try to maxmimize this list. -@@ -2967,3 +2968,25 @@ $(objpfx)tst-tls-allocation-failure-static-patched.out: \ +@@ -2967,3 +2986,33 @@ $(objpfx)tst-tls-allocation-failure-static-patched.out: \ grep -q '^Fatal glibc error: Cannot allocate TLS block$$' $@ \ && grep -q '^status: 127$$' $@; \ $(evaluate-test) @@ -491,6 +695,27 @@ index fd77d0c7c8..cea9c1b29d 100644 +$(objpfx)tst-dlmopen-twice.out: \ + $(objpfx)tst-dlmopen-twice-mod1.so \ + $(objpfx)tst-dlmopen-twice-mod2.so ++ ++$(objpfx)tst-recursive-tls: $(objpfx)tst-recursive-tlsmallocmod.so ++# More objects than DTV_SURPLUS, to trigger DTV reallocation. ++$(objpfx)tst-recursive-tls.out: \ ++ $(patsubst %,$(objpfx)tst-recursive-tlsmod%.so, \ ++ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15) ++$(objpfx)tst-recursive-tlsmod%.os: tst-recursive-tlsmodN.c ++ $(compile-command.c) -DVAR=thread_$* -DFUNC=get_threadvar_$* +diff --git a/elf/cache.c b/elf/cache.c +index 3d7d3a67bf..528a8ba694 100644 +--- a/elf/cache.c ++++ b/elf/cache.c +@@ -845,7 +845,7 @@ struct aux_cache_entry + struct aux_cache_entry *next; + }; + +-#define AUX_CACHEMAGIC "glibc-ld.so.auxcache-1.0" ++#define AUX_CACHEMAGIC "glibc-ld.so.auxcache-2.0" + + struct aux_cache_file_entry + { diff --git a/elf/dl-cache.c b/elf/dl-cache.c index 8bbf110d02..b97c17b3a9 100644 --- a/elf/dl-cache.c @@ -564,7 +789,7 @@ index 0000000000..9e7ba10fa2 + DL_CALL_DT_FINI (map, ((void *) map->l_addr + fini->d_un.d_ptr)); +} diff --git a/elf/dl-close.c b/elf/dl-close.c -index bcd6e206e9..14deca2e2b 100644 +index bcd6e206e9..ef909d8c66 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -36,11 +36,6 @@ @@ -630,6 +855,15 @@ index bcd6e206e9..14deca2e2b 100644 #ifdef SHARED /* Auditing checkpoint: we remove an object. */ +@@ -743,7 +703,7 @@ _dl_close_worker (struct link_map *map, bool force) + if (__glibc_unlikely (newgen == 0)) + _dl_fatal_printf ("TLS generation counter wrapped! Please report as described in "REPORT_BUGS_TO".\n"); + /* Can be read concurrently. */ +- atomic_store_relaxed (&GL(dl_tls_generation), newgen); ++ atomic_store_release (&GL(dl_tls_generation), newgen); + + if (tls_free_end == GL(dl_tls_static_used)) + GL(dl_tls_static_used) = tls_free_start; diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c index 4d5831b6f4..2e5b456c11 100644 --- a/elf/dl-find_object.c @@ -785,9 +1019,38 @@ index 4c86dc694e..67fb2e31e2 100644 return LOOKUP_VALUE (current_value.m); } diff --git a/elf/dl-open.c b/elf/dl-open.c -index a23e65926b..e7db5e9642 100644 +index a23e65926b..734a0bee4e 100644 --- a/elf/dl-open.c +++ b/elf/dl-open.c +@@ -405,7 +405,7 @@ update_tls_slotinfo (struct link_map *new) + _dl_fatal_printf (N_("\ + TLS generation counter wrapped! Please report this.")); + /* Can be read concurrently. */ +- atomic_store_relaxed (&GL(dl_tls_generation), newgen); ++ atomic_store_release (&GL(dl_tls_generation), newgen); + + /* We need a second pass for static tls data, because + _dl_update_slotinfo must not be run while calls to +@@ -422,8 +422,8 @@ TLS generation counter wrapped! Please report this.")); + now, but we can delay updating the DTV. */ + imap->l_need_tls_init = 0; + #ifdef SHARED +- /* Update the slot information data for at least the +- generation of the DSO we are allocating data for. */ ++ /* Update the slot information data for the current ++ generation. */ + + /* FIXME: This can terminate the process on memory + allocation failure. It is not possible to raise +@@ -431,7 +431,7 @@ TLS generation counter wrapped! Please report this.")); + _dl_update_slotinfo would have to be split into two + operations, similar to resize_scopes and update_scopes + above. This is related to bug 16134. */ +- _dl_update_slotinfo (imap->l_tls_modid); ++ _dl_update_slotinfo (imap->l_tls_modid, newgen); + #endif + + dl_init_static_tls (imap); @@ -850,6 +850,7 @@ no more namespaces available for dlmopen()")); ++GL(dl_nns); } @@ -796,6 +1059,25 @@ index a23e65926b..e7db5e9642 100644 _dl_debug_update (nsid)->r_state = RT_CONSISTENT; } /* Never allow loading a DSO in a namespace which is empty. Such +diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c +index 756bf950f6..88816a715f 100644 +--- a/elf/dl-reloc.c ++++ b/elf/dl-reloc.c +@@ -112,11 +112,11 @@ _dl_try_allocate_static_tls (struct link_map *map, bool optional) + if (map->l_real->l_relocated) + { + #ifdef SHARED ++ /* Update the DTV of the current thread. Note: GL(dl_load_tls_lock) ++ is held here so normal load of the generation counter is valid. */ + if (__builtin_expect (THREAD_DTV()[0].counter != GL(dl_tls_generation), + 0)) +- /* Update the slot information data for at least the generation of +- the DSO we are allocating data for. */ +- (void) _dl_update_slotinfo (map->l_tls_modid); ++ (void) _dl_update_slotinfo (map->l_tls_modid, GL(dl_tls_generation)); + #endif + + dl_init_static_tls (map); diff --git a/elf/dl-sort-maps.c b/elf/dl-sort-maps.c index 96638d7ed1..3e2a6a584e 100644 --- a/elf/dl-sort-maps.c @@ -956,10 +1238,42 @@ index 4af0b5b2ce..f45b630ba5 100644 call_function_static_weak (_dl_find_object_init); diff --git a/elf/dl-tls.c b/elf/dl-tls.c -index 093cdddb7e..bf0ff0d9e8 100644 +index 093cdddb7e..c6c2137092 100644 --- a/elf/dl-tls.c +++ b/elf/dl-tls.c -@@ -160,6 +160,7 @@ _dl_assign_tls_modid (struct link_map *l) +@@ -75,6 +75,31 @@ + /* Default for dl_tls_static_optional. */ + #define OPTIONAL_TLS 512 + ++/* Used to count the number of threads currently executing dynamic TLS ++ updates. Used to avoid recursive malloc calls in __tls_get_addr ++ for an interposed malloc that uses global-dynamic TLS (which is not ++ recommended); see _dl_tls_allocate_active checks. This could be a ++ per-thread flag, but would need TLS access in the dynamic linker. */ ++unsigned int _dl_tls_threads_in_update; ++ ++static inline void ++_dl_tls_allocate_begin (void) ++{ ++ atomic_fetch_add_relaxed (&_dl_tls_threads_in_update, 1); ++} ++ ++static inline void ++_dl_tls_allocate_end (void) ++{ ++ atomic_fetch_add_relaxed (&_dl_tls_threads_in_update, -1); ++} ++ ++static inline bool ++_dl_tls_allocate_active (void) ++{ ++ return atomic_load_relaxed (&_dl_tls_threads_in_update) > 0; ++} ++ + /* Compute the static TLS surplus based on the namespace count and the + TLS space that can be used for optimizations. */ + static inline int +@@ -160,6 +185,7 @@ _dl_assign_tls_modid (struct link_map *l) { /* Mark the entry as used, so any dependency see it. */ atomic_store_relaxed (&runp->slotinfo[result - disp].map, l); @@ -967,6 +1281,331 @@ index 093cdddb7e..bf0ff0d9e8 100644 break; } +@@ -430,12 +456,18 @@ _dl_allocate_tls_storage (void) + size += TLS_PRE_TCB_SIZE; + #endif + +- /* Perform the allocation. Reserve space for the required alignment +- and the pointer to the original allocation. */ ++ /* Reserve space for the required alignment and the pointer to the ++ original allocation. */ + size_t alignment = GLRO (dl_tls_static_align); ++ ++ /* Perform the allocation. */ ++ _dl_tls_allocate_begin (); + void *allocated = malloc (size + alignment + sizeof (void *)); + if (__glibc_unlikely (allocated == NULL)) +- return NULL; ++ { ++ _dl_tls_allocate_end (); ++ return NULL; ++ } + + /* Perform alignment and allocate the DTV. */ + #if TLS_TCB_AT_TP +@@ -471,6 +503,8 @@ _dl_allocate_tls_storage (void) + result = allocate_dtv (result); + if (result == NULL) + free (allocated); ++ ++ _dl_tls_allocate_end (); + return result; + } + +@@ -488,6 +522,7 @@ _dl_resize_dtv (dtv_t *dtv, size_t max_modid) + size_t newsize = max_modid + DTV_SURPLUS; + size_t oldsize = dtv[-1].counter; + ++ _dl_tls_allocate_begin (); + if (dtv == GL(dl_initial_dtv)) + { + /* This is the initial dtv that was either statically allocated in +@@ -507,6 +542,7 @@ _dl_resize_dtv (dtv_t *dtv, size_t max_modid) + if (newp == NULL) + oom (); + } ++ _dl_tls_allocate_end (); + + newp[0].counter = newsize; + +@@ -681,7 +717,9 @@ allocate_dtv_entry (size_t alignment, size_t size) + if (powerof2 (alignment) && alignment <= _Alignof (max_align_t)) + { + /* The alignment is supported by malloc. */ ++ _dl_tls_allocate_begin (); + void *ptr = malloc (size); ++ _dl_tls_allocate_end (); + return (struct dtv_pointer) { ptr, ptr }; + } + +@@ -693,7 +731,10 @@ allocate_dtv_entry (size_t alignment, size_t size) + + /* Perform the allocation. This is the pointer we need to free + later. */ ++ _dl_tls_allocate_begin (); + void *start = malloc (alloc_size); ++ _dl_tls_allocate_end (); ++ + if (start == NULL) + return (struct dtv_pointer) {}; + +@@ -721,57 +762,57 @@ allocate_and_init (struct link_map *map) + + + struct link_map * +-_dl_update_slotinfo (unsigned long int req_modid) ++_dl_update_slotinfo (unsigned long int req_modid, size_t new_gen) + { + struct link_map *the_map = NULL; + dtv_t *dtv = THREAD_DTV (); + +- /* The global dl_tls_dtv_slotinfo array contains for each module +- index the generation counter current when the entry was created. ++ /* CONCURRENCY NOTES: ++ ++ The global dl_tls_dtv_slotinfo_list array contains for each module ++ index the generation counter current when that entry was updated. + This array never shrinks so that all module indices which were +- valid at some time can be used to access it. Before the first +- use of a new module index in this function the array was extended +- appropriately. Access also does not have to be guarded against +- modifications of the array. It is assumed that pointer-size +- values can be read atomically even in SMP environments. It is +- possible that other threads at the same time dynamically load +- code and therefore add to the slotinfo list. This is a problem +- since we must not pick up any information about incomplete work. +- The solution to this is to ignore all dtv slots which were +- created after the one we are currently interested. We know that +- dynamic loading for this module is completed and this is the last +- load operation we know finished. */ +- unsigned long int idx = req_modid; ++ valid at some time can be used to access it. Concurrent loading ++ and unloading of modules can update slotinfo entries or extend ++ the array. The updates happen under the GL(dl_load_tls_lock) and ++ finish with the release store of the generation counter to ++ GL(dl_tls_generation) which is synchronized with the load of ++ new_gen in the caller. So updates up to new_gen are synchronized ++ but updates for later generations may not be. ++ ++ Here we update the thread dtv from old_gen (== dtv[0].counter) to ++ new_gen generation. For this, each dtv[i] entry is either set to ++ an unallocated state (set), or left unmodified (nop). Where (set) ++ may resize the dtv first if modid i >= dtv[-1].counter. The rules ++ for the decision between (set) and (nop) are ++ ++ (1) If slotinfo entry i is concurrently updated then either (set) ++ or (nop) is valid: TLS access cannot use dtv[i] unless it is ++ synchronized with a generation > new_gen. ++ ++ Otherwise, if the generation of slotinfo entry i is gen and the ++ loaded module for this entry is map then ++ ++ (2) If gen <= old_gen then do (nop). ++ ++ (3) If old_gen < gen <= new_gen then ++ (3.1) if map != 0 then (set) ++ (3.2) if map == 0 then either (set) or (nop). ++ ++ Note that (1) cannot be reliably detected, but since both actions ++ are valid it does not have to be. Only (2) and (3.1) cases need ++ to be distinguished for which relaxed mo access of gen and map is ++ enough: their value is synchronized when it matters. ++ ++ Note that a relaxed mo load may give an out-of-thin-air value since ++ it is used in decisions that can affect concurrent stores. But this ++ should only happen if the OOTA value causes UB that justifies the ++ concurrent store of the value. This is not expected to be an issue ++ in practice. */ + struct dtv_slotinfo_list *listp = GL(dl_tls_dtv_slotinfo_list); + +- while (idx >= listp->len) +- { +- idx -= listp->len; +- listp = listp->next; +- } +- +- if (dtv[0].counter < listp->slotinfo[idx].gen) ++ if (dtv[0].counter < new_gen) + { +- /* CONCURRENCY NOTES: +- +- Here the dtv needs to be updated to new_gen generation count. +- +- This code may be called during TLS access when GL(dl_load_tls_lock) +- is not held. In that case the user code has to synchronize with +- dlopen and dlclose calls of relevant modules. A module m is +- relevant if the generation of m <= new_gen and dlclose of m is +- synchronized: a memory access here happens after the dlopen and +- before the dlclose of relevant modules. The dtv entries for +- relevant modules need to be updated, other entries can be +- arbitrary. +- +- This e.g. means that the first part of the slotinfo list can be +- accessed race free, but the tail may be concurrently extended. +- Similarly relevant slotinfo entries can be read race free, but +- other entries are racy. However updating a non-relevant dtv +- entry does not affect correctness. For a relevant module m, +- max_modid >= modid of m. */ +- size_t new_gen = listp->slotinfo[idx].gen; + size_t total = 0; + size_t max_modid = atomic_load_relaxed (&GL(dl_tls_max_dtv_idx)); + assert (max_modid >= req_modid); +@@ -784,31 +825,33 @@ _dl_update_slotinfo (unsigned long int req_modid) + { + size_t modid = total + cnt; + +- /* Later entries are not relevant. */ ++ /* Case (1) for all later modids. */ + if (modid > max_modid) + break; + + size_t gen = atomic_load_relaxed (&listp->slotinfo[cnt].gen); + ++ /* Case (1). */ + if (gen > new_gen) +- /* Not relevant. */ + continue; + +- /* If the entry is older than the current dtv layout we +- know we don't have to handle it. */ ++ /* Case (2) or (1). */ + if (gen <= dtv[0].counter) + continue; + ++ /* Case (3) or (1). */ ++ + /* If there is no map this means the entry is empty. */ + struct link_map *map + = atomic_load_relaxed (&listp->slotinfo[cnt].map); + /* Check whether the current dtv array is large enough. */ + if (dtv[-1].counter < modid) + { ++ /* Case (3.2) or (1). */ + if (map == NULL) + continue; + +- /* Resize the dtv. */ ++ /* Resizing the dtv aborts on failure: bug 16134. */ + dtv = _dl_resize_dtv (dtv, max_modid); + + assert (modid <= dtv[-1].counter); +@@ -819,10 +862,21 @@ _dl_update_slotinfo (unsigned long int req_modid) + } + + /* If there is currently memory allocate for this +- dtv entry free it. */ ++ dtv entry free it. Note: this is not AS-safe. */ + /* XXX Ideally we will at some point create a memory + pool. */ +- free (dtv[modid].pointer.to_free); ++ /* Avoid calling free on a null pointer. Some mallocs ++ incorrectly use dynamic TLS, and depending on how the ++ free function was compiled, it could call ++ __tls_get_addr before the null pointer check in the ++ free implementation. Checking here papers over at ++ least some dynamic TLS usage by interposed mallocs. */ ++ if (dtv[modid].pointer.to_free != NULL) ++ { ++ _dl_tls_allocate_begin (); ++ free (dtv[modid].pointer.to_free); ++ _dl_tls_allocate_end (); ++ } + dtv[modid].pointer.val = TLS_DTV_UNALLOCATED; + dtv[modid].pointer.to_free = NULL; + +@@ -914,9 +968,9 @@ tls_get_addr_tail (GET_ADDR_ARGS, dtv_t *dtv, struct link_map *the_map) + + static struct link_map * + __attribute_noinline__ +-update_get_addr (GET_ADDR_ARGS) ++update_get_addr (GET_ADDR_ARGS, size_t gen) + { +- struct link_map *the_map = _dl_update_slotinfo (GET_ADDR_MODULE); ++ struct link_map *the_map = _dl_update_slotinfo (GET_ADDR_MODULE, gen); + dtv_t *dtv = THREAD_DTV (); + + void *p = dtv[GET_ADDR_MODULE].pointer.val; +@@ -946,12 +1000,29 @@ __tls_get_addr (GET_ADDR_ARGS) + dtv_t *dtv = THREAD_DTV (); + + /* Update is needed if dtv[0].counter < the generation of the accessed +- module. The global generation counter is used here as it is easier +- to check. Synchronization for the relaxed MO access is guaranteed +- by user code, see CONCURRENCY NOTES in _dl_update_slotinfo. */ ++ module, but the global generation counter is easier to check (which ++ must be synchronized up to the generation of the accessed module by ++ user code doing the TLS access so relaxed mo read is enough). */ + size_t gen = atomic_load_relaxed (&GL(dl_tls_generation)); + if (__glibc_unlikely (dtv[0].counter != gen)) +- return update_get_addr (GET_ADDR_PARAM); ++ { ++ if (_dl_tls_allocate_active () ++ && GET_ADDR_MODULE < _dl_tls_initial_modid_limit) ++ /* This is a reentrant __tls_get_addr call, but we can ++ satisfy it because it's an initially-loaded module ID. ++ These TLS slotinfo slots do not change, so the ++ out-of-date generation counter does not matter. However, ++ if not in a TLS update, still update_get_addr below, to ++ get off the slow path eventually. */ ++ ; ++ else ++ { ++ /* Update DTV up to the global generation, see CONCURRENCY NOTES ++ in _dl_update_slotinfo. */ ++ gen = atomic_load_acquire (&GL(dl_tls_generation)); ++ return update_get_addr (GET_ADDR_PARAM, gen); ++ } ++ } + + void *p = dtv[GET_ADDR_MODULE].pointer.val; + +@@ -960,7 +1031,7 @@ __tls_get_addr (GET_ADDR_ARGS) + + return (char *) p + GET_ADDR_OFFSET; + } +-#endif ++#endif /* SHARED */ + + + /* Look up the module's TLS block as for __tls_get_addr, +@@ -1009,6 +1080,25 @@ _dl_tls_get_addr_soft (struct link_map *l) + return data; + } + ++size_t _dl_tls_initial_modid_limit; ++ ++void ++_dl_tls_initial_modid_limit_setup (void) ++{ ++ struct dtv_slotinfo_list *listp = GL(dl_tls_dtv_slotinfo_list); ++ size_t idx; ++ for (idx = 0; idx < listp->len; ++idx) ++ { ++ struct link_map *l = listp->slotinfo[idx].map; ++ if (l == NULL ++ /* The object can be unloaded, so its modid can be ++ reassociated. */ ++ || !(l->l_type == lt_executable || l->l_type == lt_library)) ++ break; ++ } ++ _dl_tls_initial_modid_limit = idx; ++} ++ + + void + _dl_add_to_slotinfo (struct link_map *l, bool do_add) +@@ -1041,9 +1131,11 @@ _dl_add_to_slotinfo (struct link_map *l, bool do_add) + the first slot. */ + assert (idx == 0); + ++ _dl_tls_allocate_begin (); + listp = (struct dtv_slotinfo_list *) + malloc (sizeof (struct dtv_slotinfo_list) + + TLS_SLOTINFO_SURPLUS * sizeof (struct dtv_slotinfo)); ++ _dl_tls_allocate_end (); + if (listp == NULL) + { + /* We ran out of memory while resizing the dtv slotinfo list. */ diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c index 8e7ee9df10..76cf8b9da3 100644 --- a/elf/dl-tunables.c @@ -1165,10 +1804,19 @@ index ca00dd1fe2..3c5e273f2b 100644 else # -s verbose := diff --git a/elf/rtld.c b/elf/rtld.c -index cbbaf4a331..3e771a93d8 100644 +index cbbaf4a331..6e40893e52 100644 --- a/elf/rtld.c +++ b/elf/rtld.c -@@ -2122,6 +2122,12 @@ dl_main (const ElfW(Phdr) *phdr, +@@ -791,6 +791,8 @@ init_tls (size_t naudit) + _dl_fatal_printf ("\ + cannot allocate TLS data structures for initial thread\n"); + ++ _dl_tls_initial_modid_limit_setup (); ++ + /* Store for detection of the special case by __tls_get_addr + so it knows not to pass this dtv to the normal realloc. */ + GL(dl_initial_dtv) = GET_DTV (tcbp); +@@ -2122,6 +2124,12 @@ dl_main (const ElfW(Phdr) *phdr, if (l->l_faked) /* The library was not found. */ _dl_printf ("\t%s => not found\n", l->l_libname->name); @@ -1536,6 +2184,176 @@ index 0000000000..ec937bf4ec +esac + +exit $errors +diff --git a/elf/tst-recursive-tls.c b/elf/tst-recursive-tls.c +new file mode 100644 +index 0000000000..716d1f783a +--- /dev/null ++++ b/elf/tst-recursive-tls.c +@@ -0,0 +1,60 @@ ++/* Test with interposed malloc with dynamic TLS. ++ Copyright (C) 2024 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <array_length.h> ++#include <stdio.h> ++#include <support/check.h> ++#include <support/xdlfcn.h> ++ ++/* Defined in tst-recursive-tlsmallocmod.so. */ ++extern __thread unsigned int malloc_subsytem_counter; ++ ++static int ++do_test (void) ++{ ++ /* 16 is large enough to exercise the DTV resizing case. */ ++ void *handles[16]; ++ ++ for (unsigned int i = 0; i < array_length (handles); ++i) ++ { ++ /* Re-use the TLS slot for module 0. */ ++ if (i > 0) ++ xdlclose (handles[0]); ++ ++ char soname[30]; ++ snprintf (soname, sizeof (soname), "tst-recursive-tlsmod%u.so", i); ++ handles[i] = xdlopen (soname, RTLD_NOW); ++ ++ if (i > 0) ++ { ++ handles[0] = xdlopen ("tst-recursive-tlsmod0.so", RTLD_NOW); ++ int (*fptr) (void) = xdlsym (handles[0], "get_threadvar_0"); ++ /* May trigger TLS storage allocation using malloc. */ ++ TEST_COMPARE (fptr (), 0); ++ } ++ } ++ ++ for (unsigned int i = 0; i < array_length (handles); ++i) ++ xdlclose (handles[i]); ++ ++ printf ("info: malloc subsystem calls: %u\n", malloc_subsytem_counter); ++ TEST_VERIFY (malloc_subsytem_counter > 0); ++ return 0; ++} ++ ++#include <support/test-driver.c> +diff --git a/elf/tst-recursive-tlsmallocmod.c b/elf/tst-recursive-tlsmallocmod.c +new file mode 100644 +index 0000000000..c24e9945d1 +--- /dev/null ++++ b/elf/tst-recursive-tlsmallocmod.c +@@ -0,0 +1,64 @@ ++/* Interposed malloc with dynamic TLS. ++ Copyright (C) 2024 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <stdlib.h> ++#include <dlfcn.h> ++ ++__thread unsigned int malloc_subsytem_counter; ++ ++static __typeof (malloc) *malloc_fptr; ++static __typeof (free) *free_fptr; ++static __typeof (calloc) *calloc_fptr; ++static __typeof (realloc) *realloc_fptr; ++ ++static void __attribute__ ((constructor)) ++init (void) ++{ ++ malloc_fptr = dlsym (RTLD_NEXT, "malloc"); ++ free_fptr = dlsym (RTLD_NEXT, "free"); ++ calloc_fptr = dlsym (RTLD_NEXT, "calloc"); ++ realloc_fptr = dlsym (RTLD_NEXT, "realloc"); ++} ++ ++void * ++malloc (size_t size) ++{ ++ ++malloc_subsytem_counter; ++ return malloc_fptr (size); ++} ++ ++void ++free (void *ptr) ++{ ++ ++malloc_subsytem_counter; ++ return free_fptr (ptr); ++} ++ ++void * ++calloc (size_t a, size_t b) ++{ ++ ++malloc_subsytem_counter; ++ return calloc_fptr (a, b); ++} ++ ++void * ++realloc (void *ptr, size_t size) ++{ ++ ++malloc_subsytem_counter; ++ return realloc_fptr (ptr, size); ++} +diff --git a/elf/tst-recursive-tlsmodN.c b/elf/tst-recursive-tlsmodN.c +new file mode 100644 +index 0000000000..bb7592aee6 +--- /dev/null ++++ b/elf/tst-recursive-tlsmodN.c +@@ -0,0 +1,28 @@ ++/* Test module with global-dynamic TLS. Used to trigger DTV reallocation. ++ Copyright (C) 2024 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++/* Compiled with VAR and FUNC set via -D. FUNC requires some ++ relocation against TLS variable VAR. */ ++ ++__thread int VAR; ++ ++int ++FUNC (void) ++{ ++ return VAR; ++} diff --git a/elf/tst-stackguard1.c b/elf/tst-stackguard1.c index 050784319a..98625632dc 100644 --- a/elf/tst-stackguard1.c @@ -3888,7 +4706,7 @@ index 90187e30b1..5b9dd50151 100644 if ((flags & NO_CACHE) == 0) *dir = nis_server_cache_search (name, search_parent, &server_used, diff --git a/nptl/descr.h b/nptl/descr.h -index 5cacb286f3..ff634dac33 100644 +index 5cacb286f3..bbb26607ef 100644 --- a/nptl/descr.h +++ b/nptl/descr.h @@ -34,7 +34,6 @@ @@ -3899,7 +4717,7 @@ index 5cacb286f3..ff634dac33 100644 #include <internal-sigset.h> #ifndef TCB_ALIGNMENT -@@ -402,14 +401,25 @@ struct pthread +@@ -402,14 +401,27 @@ struct pthread /* Used on strsignal. */ struct tls_internal_t tls_state; @@ -3919,6 +4737,8 @@ index 5cacb286f3..ff634dac33 100644 + { + uint32_t cpu_id_start; + uint32_t cpu_id; ++ uint64_t rseq_cs; ++ uint32_t flags; + }; + char pad[32]; /* Original rseq area size. */ + } rseq_area __attribute__ ((aligned (32))); @@ -3946,6 +4766,101 @@ index 903457db76..1c80457553 100644 /* This call should never return. */ return NULL; } +diff --git a/nptl/tst-setuid2.c b/nptl/tst-setuid2.c +index aff3b1a97d..9b7799991c 100644 +--- a/nptl/tst-setuid2.c ++++ b/nptl/tst-setuid2.c +@@ -20,6 +20,7 @@ + #include <signal.h> + #include <stdbool.h> + #include <stdio.h> ++#include <support/xthread.h> + #include <sys/syscall.h> + #include <unistd.h> + +@@ -36,30 +37,21 @@ static pthread_cond_t cond_recv; + static void * + thread_func (void *ctx __attribute__ ((unused))) + { +- int ret = pthread_mutex_lock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_lock (thread): %d", ret); +- ++ xpthread_mutex_lock (&mutex); + while (true) + { + if (func_sent != NULL) + { + void (*func) (void) = func_sent; +- ret = pthread_mutex_unlock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_unlock (thread): %d", ret); ++ xpthread_mutex_unlock (&mutex); ++ + func (); +- ret = pthread_mutex_lock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_lock (thread): %d", ret); ++ ++ xpthread_mutex_lock (&mutex); + func_sent = NULL; +- ret = pthread_cond_signal (&cond_recv); +- if (ret != 0) +- FAIL ("pthread_cond_signal (recv): %d", ret); ++ xpthread_cond_signal (&cond_recv); + } +- ret = pthread_cond_wait (&cond_send, &mutex); +- if (ret != 0) +- FAIL ("pthread_cond_wait (send): %d", ret); ++ xpthread_cond_wait (&cond_send, &mutex); + } + return NULL; + } +@@ -67,31 +59,18 @@ thread_func (void *ctx __attribute__ ((unused))) + static void + run_on_thread (void (*func) (void)) + { +- int ret = pthread_mutex_lock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_lock (%s): %d", __func__, ret); ++ xpthread_mutex_lock (&mutex); + func_sent = func; +- ret = pthread_mutex_unlock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_unlock (%s): %d", __func__, ret); ++ xpthread_mutex_unlock (&mutex); + +- ret = pthread_cond_signal (&cond_send); +- if (ret != 0) +- FAIL ("pthread_mutex_lock (%s): %d", __func__, ret); +- +- ret = pthread_mutex_lock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_lock (%s): %d", __func__, ret); ++ xpthread_cond_signal (&cond_send); + ++ xpthread_mutex_lock (&mutex); + while (func_sent != NULL) + { +- ret = pthread_cond_wait (&cond_recv, &mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_wait (%s): %d", __func__, ret); ++ xpthread_cond_wait (&cond_recv, &mutex); + } +- ret = pthread_mutex_unlock (&mutex); +- if (ret != 0) +- FAIL ("pthread_mutex_unlock (%s): %d", __func__, ret); ++ xpthread_mutex_unlock (&mutex); + } + + static void +@@ -141,5 +120,4 @@ do_test (void) + return 0; + } + +-#define TEST_FUNCTION do_test () +-#include "../test-skeleton.c" ++#include <support/test-driver.c> diff --git a/nptl/tst-stackguard1.c b/nptl/tst-stackguard1.c index 3460c01819..bc8900ce22 100644 --- a/nptl/tst-stackguard1.c @@ -9549,7 +10464,7 @@ index 1344b2b591..388b202493 100644 + +#include <support/test-driver.c> diff --git a/stdlib/Makefile b/stdlib/Makefile -index f7b25c1981..3d49c4941a 100644 +index f7b25c1981..2da3030efc 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -171,6 +171,7 @@ tests := \ @@ -9560,6 +10475,14 @@ index f7b25c1981..3d49c4941a 100644 test-bz22786 \ test-canon \ test-canon2 \ +@@ -221,6 +222,7 @@ tests := \ + tst-setcontext7 \ + tst-setcontext8 \ + tst-setcontext9 \ ++ tst-setenv-environ \ + tst-strfmon_l \ + tst-strfrom \ + tst-strfrom-locale \ diff --git a/stdlib/arc4random.c b/stdlib/arc4random.c index e417ef624d..960a38f295 100644 --- a/stdlib/arc4random.c @@ -9728,6 +10651,48 @@ index 0000000000..0596b9763b + +#define TEST_FUNCTION do_test +#include <support/test-driver.c> +diff --git a/stdlib/tst-setenv-environ.c b/stdlib/tst-setenv-environ.c +new file mode 100644 +index 0000000000..02fcef96d0 +--- /dev/null ++++ b/stdlib/tst-setenv-environ.c +@@ -0,0 +1,36 @@ ++/* Test using setenv with updated environ. ++ Copyright (C) 2025 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <stdlib.h> ++#include <support/check.h> ++ ++extern char **environ; ++ ++int ++do_test (void) ++{ ++ char *valp; ++ static char *dummy_environ[] = { NULL }; ++ environ = dummy_environ; ++ setenv ("A", "1", 0); ++ valp = getenv ("A"); ++ TEST_VERIFY_EXIT (valp[0] == '1' && valp[1] == '\0'); ++ return 0; ++} ++ ++#include <support/test-driver.c> diff --git a/stdlib/tst-system.c b/stdlib/tst-system.c index f7fa74b2a6..5e0c79475f 100644 --- a/stdlib/tst-system.c @@ -9897,7 +10862,7 @@ index bf7f0b81c4..c1d1c43e50 100644 if (netname[i - 1] == '.') netname[i - 1] = '\0'; diff --git a/support/Makefile b/support/Makefile -index 9b50eac117..7c572fbe4a 100644 +index 9b50eac117..c8c1363b76 100644 --- a/support/Makefile +++ b/support/Makefile @@ -32,6 +32,8 @@ libsupport-routines = \ @@ -9909,7 +10874,15 @@ index 9b50eac117..7c572fbe4a 100644 ignore_stderr \ next_to_fault \ oom_error \ -@@ -205,6 +207,7 @@ libsupport-routines = \ +@@ -159,6 +161,7 @@ libsupport-routines = \ + xpthread_cancel \ + xpthread_check_return \ + xpthread_cond_wait \ ++ xpthread_cond_signal \ + xpthread_create \ + xpthread_detach \ + xpthread_join \ +@@ -205,6 +208,7 @@ libsupport-routines = \ xstrndup \ xsymlink \ xsysconf \ @@ -9917,7 +10890,7 @@ index 9b50eac117..7c572fbe4a 100644 xunlink \ xuselocale \ xwaitpid \ -@@ -237,6 +240,24 @@ CFLAGS-support_paths.c = \ +@@ -237,6 +241,24 @@ CFLAGS-support_paths.c = \ CFLAGS-timespec.c += -fexcess-precision=standard CFLAGS-timespec-time64.c += -fexcess-precision=standard @@ -10191,6 +11164,38 @@ index 4d2ac2737d..1bba3a6837 100644 #endif /* Check that the timespec on the left represents a time before the +diff --git a/support/xpthread_cond_signal.c b/support/xpthread_cond_signal.c +new file mode 100644 +index 0000000000..ed0be1a8ab +--- /dev/null ++++ b/support/xpthread_cond_signal.c +@@ -0,0 +1,26 @@ ++/* pthread_cond_signal with error checking. ++ Copyright (C) 2022 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <support/xthread.h> ++ ++void ++xpthread_cond_signal (pthread_cond_t *cond) ++{ ++ xpthread_check_return ++ ("pthread_cond_signal", pthread_cond_signal (cond)); ++} diff --git a/support/xstdlib.h b/support/xstdlib.h new file mode 100644 index 0000000000..db5a5b9d4f @@ -10271,6 +11276,18 @@ index 0000000000..1f558953bc + if (ret < 0) + FAIL_EXIT1 ("system (\"%s\")", cmd); +} +diff --git a/support/xthread.h b/support/xthread.h +index af06715f46..ae09649325 100644 +--- a/support/xthread.h ++++ b/support/xthread.h +@@ -62,6 +62,7 @@ void xpthread_mutex_consistent (pthread_mutex_t *); + void xpthread_spin_lock (pthread_spinlock_t *lock); + void xpthread_spin_unlock (pthread_spinlock_t *lock); + void xpthread_cond_wait (pthread_cond_t * cond, pthread_mutex_t * mutex); ++void xpthread_cond_signal (pthread_cond_t *cond); + pthread_t xpthread_create (pthread_attr_t *attr, + void *(*thread_func) (void *), void *closure); + void xpthread_detach (pthread_t thr); diff --git a/sysdeps/aarch64/configure b/sysdeps/aarch64/configure old mode 100644 new mode 100755 @@ -13343,7 +14360,7 @@ index 0000000000..8f21ebe1b6 +#define UTMP_SIZE 384 +#define LASTLOG_SIZE 292 diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h -index 050a3032de..c2627fced7 100644 +index 050a3032de..17bd399888 100644 --- a/sysdeps/generic/ldsodefs.h +++ b/sysdeps/generic/ldsodefs.h @@ -105,6 +105,9 @@ typedef struct link_map *lookup_t; @@ -13375,6 +14392,32 @@ index 050a3032de..c2627fced7 100644 /* The dynamic linker calls this function before and having changing any shared object mappings. The `r_state' member of `struct r_debug' +@@ -1257,9 +1267,24 @@ extern void _dl_add_to_slotinfo (struct link_map *l, bool do_add) + + /* Update slot information data for at least the generation of the + module with the given index. */ +-extern struct link_map *_dl_update_slotinfo (unsigned long int req_modid) ++extern struct link_map *_dl_update_slotinfo (unsigned long int req_modid, ++ size_t gen) + attribute_hidden; + ++/* The last TLS module ID that is initially loaded, plus 1. TLS ++ addresses for modules with IDs lower than that can be obtained from ++ the DTV even if its generation is outdated. */ ++extern size_t _dl_tls_initial_modid_limit attribute_hidden attribute_relro; ++ ++/* Compute _dl_tls_initial_modid_limit. To be called after initial ++ relocation. */ ++void _dl_tls_initial_modid_limit_setup (void) attribute_hidden; ++ ++/* Number of threads currently in a TLS update. This is used to ++ detect reentrant __tls_get_addr calls without a per-thread ++ flag. */ ++extern unsigned int _dl_tls_threads_in_update attribute_hidden; ++ + /* Look up the module's TLS block as for __tls_get_addr, + but never touch anything. Return null if it's not allocated yet. */ + extern void *_dl_tls_get_addr_soft (struct link_map *l) attribute_hidden; diff --git a/sysdeps/generic/libc-lock-arch.h b/sysdeps/generic/libc-lock-arch.h new file mode 100644 index 0000000000..4713b30a8a @@ -13525,6 +14568,45 @@ index 0000000000..8f21ebe1b6 @@ -0,0 +1,2 @@ +#define UTMP_SIZE 384 +#define LASTLOG_SIZE 292 +diff --git a/sysdeps/ieee754/dbl-64/s_expm1.c b/sysdeps/ieee754/dbl-64/s_expm1.c +index 8f1c95bd04..1cafeca9c0 100644 +--- a/sysdeps/ieee754/dbl-64/s_expm1.c ++++ b/sysdeps/ieee754/dbl-64/s_expm1.c +@@ -130,6 +130,11 @@ static const double + 4.00821782732936239552e-06, /* 3ED0CFCA 86E65239 */ + -2.01099218183624371326e-07 }; /* BE8AFDB7 6E09C32D */ + ++#ifndef SECTION ++# define SECTION ++#endif ++ ++SECTION + double + __expm1 (double x) + { +@@ -258,4 +263,6 @@ __expm1 (double x) + } + return y; + } ++#ifndef __expm1 + libm_alias_double (__expm1, expm1) ++#endif +diff --git a/sysdeps/ieee754/dbl-64/s_log1p.c b/sysdeps/ieee754/dbl-64/s_log1p.c +index e6476a8260..eeb0af859f 100644 +--- a/sysdeps/ieee754/dbl-64/s_log1p.c ++++ b/sysdeps/ieee754/dbl-64/s_log1p.c +@@ -99,6 +99,11 @@ static const double + + static const double zero = 0.0; + ++#ifndef SECTION ++# define SECTION ++#endif ++ ++SECTION + double + __log1p (double x) + { diff --git a/sysdeps/ieee754/ldbl-128/e_j1l.c b/sysdeps/ieee754/ldbl-128/e_j1l.c index 54c457681a..9a9c5c6f00 100644 --- a/sysdeps/ieee754/ldbl-128/e_j1l.c @@ -14022,6 +15104,29 @@ index bcff909b2f..f975dcd2bc 100644 return result; } +diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c +index 2ee0010b8d..dfa0780514 100644 +--- a/sysdeps/posix/libc_fatal.c ++++ b/sysdeps/posix/libc_fatal.c +@@ -20,6 +20,7 @@ + #include <errno.h> + #include <fcntl.h> + #include <ldsodefs.h> ++#include <libc-pointer-arith.h> + #include <paths.h> + #include <stdarg.h> + #include <stdbool.h> +@@ -125,8 +126,8 @@ __libc_message (enum __libc_message_action action, const char *fmt, ...) + + if ((action & do_abort)) + { +- total = ((total + 1 + GLRO(dl_pagesize) - 1) +- & ~(GLRO(dl_pagesize) - 1)); ++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, ++ GLRO(dl_pagesize)); + struct abort_msg_s *buf = __mmap (NULL, total, + PROT_READ | PROT_WRITE, + MAP_ANON | MAP_PRIVATE, -1, 0); diff --git a/sysdeps/posix/system.c b/sysdeps/posix/system.c index 8014f63355..20c9420dd4 100644 --- a/sysdeps/posix/system.c @@ -16118,10 +17223,10 @@ index d656aedcc2..4e65f337d4 100644 #define __NR_mincore 232 #define __NR_mkdirat 34 diff --git a/sysdeps/unix/sysv/linux/rseq-internal.h b/sysdeps/unix/sysv/linux/rseq-internal.h -index 210f3ec566..f08a70dfc4 100644 +index 210f3ec566..1aa63eca67 100644 --- a/sysdeps/unix/sysv/linux/rseq-internal.h +++ b/sysdeps/unix/sysv/linux/rseq-internal.h -@@ -25,15 +25,34 @@ +@@ -25,18 +25,48 @@ #include <stdio.h> #include <sys/rseq.h> @@ -16151,6 +17256,15 @@ index 210f3ec566..f08a70dfc4 100644 + /* The initial implementation used only 20 bytes out of 32, + but still expected size 32. */ + size = RSEQ_AREA_SIZE_INITIAL; ++ ++ /* Initialize the rseq fields that are read by the kernel on ++ registration, there is no guarantee that struct pthread is ++ cleared on all architectures. */ ++ THREAD_SETMEM (self, rseq_area.cpu_id, RSEQ_CPU_ID_UNINITIALIZED); ++ THREAD_SETMEM (self, rseq_area.cpu_id_start, 0); ++ THREAD_SETMEM (self, rseq_area.rseq_cs, 0); ++ THREAD_SETMEM (self, rseq_area.flags, 0); ++ int ret = INTERNAL_SYSCALL_CALL (rseq, &self->rseq_area, - sizeof (self->rseq_area), - 0, RSEQ_SIG); @@ -16158,6 +17272,11 @@ index 210f3ec566..f08a70dfc4 100644 if (!INTERNAL_SYSCALL_ERROR_P (ret)) return true; } ++ /* When rseq is disabled by tunables or the registration fails, inform ++ userspace by setting 'cpu_id' to RSEQ_CPU_ID_REGISTRATION_FAILED. */ + THREAD_SETMEM (self, rseq_area.cpu_id, RSEQ_CPU_ID_REGISTRATION_FAILED); + return false; + } diff --git a/sysdeps/unix/sysv/linux/sched_getcpu.c b/sysdeps/unix/sysv/linux/sched_getcpu.c index 5c3301004c..3a2f712386 100644 --- a/sysdeps/unix/sysv/linux/sched_getcpu.c @@ -16963,6 +18082,174 @@ index fa6a89541f..613593f7f9 100644 do_rseq_main_test (); } #else /* RSEQ_SIG */ +diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile +index 56fd5fc805..d680a92695 100644 +--- a/sysdeps/x86/Makefile ++++ b/sysdeps/x86/Makefile +@@ -10,38 +10,53 @@ sysdep_headers += sys/platform/x86.h bits/platform/x86.h + CFLAGS-dl-get-cpu-features.os += $(rtld-early-cflags) + CFLAGS-get-cpuid-feature-leaf.o += $(no-stack-protector) + +-tests += tst-get-cpu-features tst-get-cpu-features-static \ +- tst-cpu-features-cpuinfo tst-cpu-features-cpuinfo-static \ +- tst-cpu-features-supports tst-cpu-features-supports-static +-tests-static += tst-get-cpu-features-static \ +- tst-cpu-features-cpuinfo-static \ +- tst-cpu-features-supports-static ++tests += \ ++ tst-get-cpu-features \ ++ tst-get-cpu-features-static \ ++ tst-cpu-features-cpuinfo \ ++ tst-cpu-features-cpuinfo-static \ ++ tst-cpu-features-supports \ ++ tst-cpu-features-supports-static \ ++# tests ++tests-static += \ ++ tst-get-cpu-features-static \ ++ tst-cpu-features-cpuinfo-static \ ++ tst-cpu-features-supports-static \ ++# tests-static + ifeq (yes,$(have-ifunc)) + ifeq (yes,$(have-gcc-ifunc)) + tests += \ + tst-ifunc-isa-1 \ +- tst-ifunc-isa-1-static ++ tst-ifunc-isa-1-static \ ++# tests + tests-static += \ +- tst-ifunc-isa-1-static ++ tst-ifunc-isa-1-static \ ++# tests-static + test-xfail-tst-ifunc-isa-1 = $(with-lld) + test-xfail-tst-ifunc-isa-1-static = $(with-lld) + ifneq ($(have-tunables),no) + tests += \ + tst-ifunc-isa-2 \ +- tst-ifunc-isa-2-static ++ tst-ifunc-isa-2-static \ ++# tests + tests-static += \ +- tst-ifunc-isa-2-static ++ tst-ifunc-isa-2-static \ ++# tests-static + test-xfail-tst-ifunc-isa-2 = $(with-lld) + test-xfail-tst-ifunc-isa-2-static = $(with-lld) + endif + endif + endif + ifeq (yes,$(enable-x86-isa-level)) +-tests += tst-isa-level-1 +-modules-names += tst-isa-level-mod-1-baseline \ +- tst-isa-level-mod-1-v2 \ +- tst-isa-level-mod-1-v3 \ +- tst-isa-level-mod-1-v4 \ ++tests += \ ++ tst-isa-level-1 \ ++# tests ++modules-names += \ ++ tst-isa-level-mod-1-baseline \ ++ tst-isa-level-mod-1-v2 \ ++ tst-isa-level-mod-1-v3 \ ++ tst-isa-level-mod-1-v4 \ ++# modules-names + + # X86 ISA level baseline + CFLAGS-tst-isa-level-mod-1-baseline.c += -DINCLUDE_X86_ISA_LEVEL \ +@@ -72,7 +87,9 @@ endif + endif + + ifeq ($(subdir),math) +-tests += tst-ldbl-nonnormal-printf ++tests += \ ++ tst-ldbl-nonnormal-printf \ ++# tests + endif # $(subdir) == math + + ifeq ($(subdir),setjmp) +@@ -80,7 +97,9 @@ gen-as-const-headers += jmp_buf-ssp.sym + sysdep_routines += __longjmp_cancel + ifneq ($(enable-cet),no) + ifneq ($(have-tunables),no) +-tests += tst-setjmp-cet ++tests += \ ++ tst-setjmp-cet \ ++# tests + tst-setjmp-cet-ENV = GLIBC_TUNABLES=glibc.cpu.x86_ibt=on:glibc.cpu.x86_shstk=on + endif + endif +@@ -128,22 +147,47 @@ ifneq ($(enable-cet),no) + ifeq ($(subdir),elf) + sysdep-dl-routines += dl-cet + +-tests += tst-cet-legacy-1 tst-cet-legacy-1a tst-cet-legacy-2 \ +- tst-cet-legacy-2a tst-cet-legacy-3 tst-cet-legacy-4 \ +- tst-cet-legacy-5a tst-cet-legacy-6a tst-cet-legacy-7 \ +- tst-cet-legacy-8 tst-cet-legacy-9 tst-cet-legacy-9-static \ +- tst-cet-legacy-10 tst-cet-legacy-10-static +-tests-static += tst-cet-legacy-9-static tst-cet-legacy-10-static ++tests += \ ++ tst-cet-legacy-1 \ ++ tst-cet-legacy-1a \ ++ tst-cet-legacy-2 \ ++ tst-cet-legacy-2a \ ++ tst-cet-legacy-3 \ ++ tst-cet-legacy-4 \ ++ tst-cet-legacy-5a \ ++ tst-cet-legacy-6a \ ++ tst-cet-legacy-7 \ ++ tst-cet-legacy-8 \ ++ tst-cet-legacy-9 \ ++ tst-cet-legacy-9-static \ ++ tst-cet-legacy-10 \ ++ tst-cet-legacy-10-static \ ++# tests ++tests-static += \ ++ tst-cet-legacy-9-static \ ++ tst-cet-legacy-10-static \ ++# tests-static + tst-cet-legacy-1a-ARGS = -- $(host-test-program-cmd) + ifneq (no,$(have-tunables)) +-tests += tst-cet-legacy-4a tst-cet-legacy-4b tst-cet-legacy-4c \ +- tst-cet-legacy-5b tst-cet-legacy-6b ++tests += \ ++ tst-cet-legacy-4a \ ++ tst-cet-legacy-4b \ ++ tst-cet-legacy-4c \ ++ tst-cet-legacy-5b \ ++ tst-cet-legacy-6b \ ++# tests + endif +-modules-names += tst-cet-legacy-mod-1 tst-cet-legacy-mod-2 \ +- tst-cet-legacy-mod-4 tst-cet-legacy-mod-5a \ +- tst-cet-legacy-mod-5b tst-cet-legacy-mod-5c \ +- tst-cet-legacy-mod-6a tst-cet-legacy-mod-6b \ +- tst-cet-legacy-mod-6c ++modules-names += \ ++ tst-cet-legacy-mod-1 \ ++ tst-cet-legacy-mod-2 \ ++ tst-cet-legacy-mod-4 \ ++ tst-cet-legacy-mod-5a \ ++ tst-cet-legacy-mod-5b \ ++ tst-cet-legacy-mod-5c \ ++ tst-cet-legacy-mod-6a \ ++ tst-cet-legacy-mod-6b \ ++ tst-cet-legacy-mod-6c \ ++# modules-names + + CFLAGS-tst-cet-legacy-2.c += -fcf-protection=branch + CFLAGS-tst-cet-legacy-2a.c += -fcf-protection +@@ -253,7 +297,9 @@ endif + ifeq ($(subdir),posix) + tests += \ + tst-sysconf-cache-linesize \ +- tst-sysconf-cache-linesize-static ++ tst-sysconf-cache-linesize-static \ ++# tests + tests-static += \ +- tst-sysconf-cache-linesize-static ++ tst-sysconf-cache-linesize-static \ ++# tests-static + endif diff --git a/sysdeps/x86/bits/wordsize.h b/sysdeps/x86/bits/wordsize.h index 70f652bca1..3f40aa76f9 100644 --- a/sysdeps/x86/bits/wordsize.h @@ -16981,10 +18268,60 @@ index 70f652bca1..3f40aa76f9 100644 -# define __WORDSIZE_TIME64_COMPAT32 0 #endif diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h -index e9f3382108..d95c1efa2c 100644 +index e9f3382108..16ee0f5b36 100644 --- a/sysdeps/x86/dl-cacheinfo.h +++ b/sysdeps/x86/dl-cacheinfo.h -@@ -478,7 +478,7 @@ handle_zhaoxin (int name) +@@ -187,7 +187,7 @@ intel_check_word (int name, unsigned int value, bool *has_level_2, + ++round; + } + /* There is no other cache information anywhere else. */ +- break; ++ return -1; + } + else + { +@@ -257,28 +257,23 @@ handle_intel (int name, const struct cpu_features *cpu_features) + + /* OK, we can use the CPUID instruction to get all info about the + caches. */ +- unsigned int cnt = 0; +- unsigned int max = 1; + long int result = 0; + bool no_level_2_or_3 = false; + bool has_level_2 = false; ++ unsigned int eax; ++ unsigned int ebx; ++ unsigned int ecx; ++ unsigned int edx; ++ __cpuid (2, eax, ebx, ecx, edx); + +- while (cnt++ < max) ++ /* The low byte of EAX of CPUID leaf 2 should always return 1 and it ++ should be ignored. If it isn't 1, use CPUID leaf 4 instead. */ ++ if ((eax & 0xff) != 1) ++ return intel_check_word (name, 0xff, &has_level_2, &no_level_2_or_3, ++ cpu_features); ++ else + { +- unsigned int eax; +- unsigned int ebx; +- unsigned int ecx; +- unsigned int edx; +- __cpuid (2, eax, ebx, ecx, edx); +- +- /* The low byte of EAX in the first round contain the number of +- rounds we have to make. At least one, the one we are already +- doing. */ +- if (cnt == 1) +- { +- max = eax & 0xff; +- eax &= 0xffffff00; +- } ++ eax &= 0xffffff00; + + /* Process the individual registers' value. */ + result = intel_check_word (name, eax, &has_level_2, +@@ -478,7 +473,7 @@ handle_zhaoxin (int name) } static void @@ -16993,7 +18330,7 @@ index e9f3382108..d95c1efa2c 100644 long int core) { unsigned int eax; -@@ -497,6 +497,7 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, +@@ -497,6 +492,7 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, unsigned int family = cpu_features->basic.family; unsigned int model = cpu_features->basic.model; long int shared = *shared_ptr; @@ -17001,7 +18338,7 @@ index e9f3382108..d95c1efa2c 100644 unsigned int threads = *threads_ptr; bool inclusive_cache = true; bool support_count_mask = true; -@@ -512,6 +513,7 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, +@@ -512,6 +508,7 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, /* Try L2 otherwise. */ level = 2; shared = core; @@ -17009,7 +18346,7 @@ index e9f3382108..d95c1efa2c 100644 threads_l2 = 0; threads_l3 = -1; } -@@ -668,29 +670,27 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, +@@ -668,29 +665,27 @@ get_common_cache_info (long int *shared_ptr, unsigned int *threads_ptr, } else { @@ -17051,7 +18388,7 @@ index e9f3382108..d95c1efa2c 100644 *threads_ptr = threads; } -@@ -704,6 +704,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -704,6 +699,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) int max_cpuid_ex; long int data = -1; long int shared = -1; @@ -17059,7 +18396,7 @@ index e9f3382108..d95c1efa2c 100644 long int core = -1; unsigned int threads = 0; unsigned long int level1_icache_size = -1; -@@ -724,6 +725,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -724,6 +720,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features); core = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features); shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features); @@ -17067,7 +18404,7 @@ index e9f3382108..d95c1efa2c 100644 level1_icache_size = handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features); -@@ -747,13 +749,14 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -747,13 +744,14 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) level4_cache_size = handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features); @@ -17083,7 +18420,7 @@ index e9f3382108..d95c1efa2c 100644 level1_icache_size = handle_zhaoxin (_SC_LEVEL1_ICACHE_SIZE); level1_icache_linesize = handle_zhaoxin (_SC_LEVEL1_ICACHE_LINESIZE); -@@ -767,13 +770,14 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -767,13 +765,14 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) level3_cache_assoc = handle_zhaoxin (_SC_LEVEL3_CACHE_ASSOC); level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE); @@ -17099,7 +18436,7 @@ index e9f3382108..d95c1efa2c 100644 level1_icache_size = handle_amd (_SC_LEVEL1_ICACHE_SIZE); level1_icache_linesize = handle_amd (_SC_LEVEL1_ICACHE_LINESIZE); -@@ -791,8 +795,11 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -791,8 +790,11 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) __cpuid (0x80000000, max_cpuid_ex, ebx, ecx, edx); if (shared <= 0) @@ -17113,7 +18450,7 @@ index e9f3382108..d95c1efa2c 100644 else { /* Figure out the number of logical threads that share L3. */ -@@ -816,7 +823,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -816,7 +818,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) /* Cap usage of highest cache level to the number of supported threads. */ if (threads > 0) @@ -17122,7 +18459,7 @@ index e9f3382108..d95c1efa2c 100644 /* Get shared cache per ccx for Zen architectures. */ if (cpu_features->basic.family >= 0x17) -@@ -827,12 +834,13 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -827,12 +829,13 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) __cpuid_count (0x8000001D, 0x3, eax, ebx, ecx, edx); unsigned int threads_per_ccx = ((eax >> 14) & 0xfff) + 1; @@ -17137,7 +18474,7 @@ index e9f3382108..d95c1efa2c 100644 } } } -@@ -850,17 +858,46 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -850,26 +853,55 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) cpu_features->level3_cache_linesize = level3_cache_linesize; cpu_features->level4_cache_size = level4_cache_size; @@ -17195,7 +18532,18 @@ index e9f3382108..d95c1efa2c 100644 #if HAVE_TUNABLES /* NB: The REP MOVSB threshold must be greater than VEC_SIZE * 8. */ -@@ -915,8 +952,8 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +- unsigned int minimum_rep_movsb_threshold; ++ unsigned long int minimum_rep_movsb_threshold; + #endif + /* NB: The default REP MOVSB threshold is 4096 * (VEC_SIZE / 16) for + VEC_SIZE == 64 or 32. For VEC_SIZE == 16, the default REP MOVSB + threshold is 2048 * (VEC_SIZE / 16). */ +- unsigned int rep_movsb_threshold; ++ unsigned long int rep_movsb_threshold; + if (CPU_FEATURE_USABLE_P (cpu_features, AVX512F) + && !CPU_FEATURE_PREFERRED_P (cpu_features, Prefer_No_AVX512)) + { +@@ -915,8 +947,8 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) shared = tunable_size; tunable_size = TUNABLE_GET (x86_non_temporal_threshold, long int, NULL); @@ -17206,7 +18554,7 @@ index e9f3382108..d95c1efa2c 100644 non_temporal_threshold = tunable_size; tunable_size = TUNABLE_GET (x86_rep_movsb_threshold, long int, NULL); -@@ -931,14 +968,9 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) +@@ -931,14 +963,9 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) TUNABLE_SET_WITH_BOUNDS (x86_data_cache_size, data, 0, SIZE_MAX); TUNABLE_SET_WITH_BOUNDS (x86_shared_cache_size, shared, 0, SIZE_MAX); @@ -17258,6 +18606,26 @@ index 0000000000..8f21ebe1b6 @@ -0,0 +1,2 @@ +#define UTMP_SIZE 384 +#define LASTLOG_SIZE 292 +diff --git a/sysdeps/x86_64/dl-tls.c b/sysdeps/x86_64/dl-tls.c +index 24a6e643b0..86517573dc 100644 +--- a/sysdeps/x86_64/dl-tls.c ++++ b/sysdeps/x86_64/dl-tls.c +@@ -40,9 +40,12 @@ __tls_get_addr_slow (GET_ADDR_ARGS) + { + dtv_t *dtv = THREAD_DTV (); + +- size_t gen = atomic_load_relaxed (&GL(dl_tls_generation)); +- if (__glibc_unlikely (dtv[0].counter != gen)) +- return update_get_addr (GET_ADDR_PARAM); ++ size_t gen = atomic_load_acquire (&GL(dl_tls_generation)); ++ if (__glibc_unlikely (dtv[0].counter != gen) ++ /* See comment in __tls_get_addr in elf/dl-tls.c. */ ++ && !(_dl_tls_allocate_active () ++ && GET_ADDR_MODULE < _dl_tls_initial_modid_limit)) ++ return update_get_addr (GET_ADDR_PARAM, gen); + + return tls_get_addr_tail (GET_ADDR_PARAM, dtv, NULL); + } diff --git a/sysdeps/x86_64/dl-tlsdesc.S b/sysdeps/x86_64/dl-tlsdesc.S index 0db2cb4152..7619e743e1 100644 --- a/sysdeps/x86_64/dl-tlsdesc.S @@ -17334,6 +18702,304 @@ index 864f4777a2..23446ff4ac 100644 (void) &f; } +diff --git a/sysdeps/x86_64/fpu/multiarch/Makefile b/sysdeps/x86_64/fpu/multiarch/Makefile +index 248162525b..ea81753b70 100644 +--- a/sysdeps/x86_64/fpu/multiarch/Makefile ++++ b/sysdeps/x86_64/fpu/multiarch/Makefile +@@ -1,32 +1,78 @@ + ifeq ($(subdir),math) +-libm-sysdep_routines += s_floor-c s_ceil-c s_floorf-c s_ceilf-c \ +- s_rint-c s_rintf-c s_nearbyint-c s_nearbyintf-c \ +- s_roundeven-c s_roundevenf-c s_trunc-c s_truncf-c ++libm-sysdep_routines += \ ++ s_ceil-c \ ++ s_ceilf-c \ ++ s_floor-c \ ++ s_floorf-c \ ++ s_rint-c \ ++ s_rintf-c \ ++ s_nearbyint-c \ ++ s_nearbyintf-c \ ++ s_roundeven-c \ ++ s_roundevenf-c \ ++ s_trunc-c \ ++ s_truncf-c \ ++# libm-sysdep_routines + +-libm-sysdep_routines += s_ceil-sse4_1 s_ceilf-sse4_1 s_floor-sse4_1 \ +- s_floorf-sse4_1 s_nearbyint-sse4_1 \ +- s_nearbyintf-sse4_1 s_roundeven-sse4_1 \ +- s_roundevenf-sse4_1 s_rint-sse4_1 s_rintf-sse4_1 \ +- s_trunc-sse4_1 s_truncf-sse4_1 ++libm-sysdep_routines += \ ++ s_ceil-sse4_1 \ ++ s_ceilf-sse4_1 \ ++ s_floor-sse4_1 \ ++ s_floorf-sse4_1 \ ++ s_nearbyint-sse4_1 \ ++ s_nearbyintf-sse4_1 \ ++ s_roundeven-sse4_1 \ ++ s_roundevenf-sse4_1 \ ++ s_rint-sse4_1 \ ++ s_rintf-sse4_1 \ ++ s_trunc-sse4_1 \ ++ s_truncf-sse4_1 \ ++# libm-sysdep_routines + +-libm-sysdep_routines += e_exp-fma e_log-fma e_pow-fma s_atan-fma \ +- e_asin-fma e_atan2-fma s_sin-fma s_tan-fma \ +- s_sincos-fma ++libm-sysdep_routines += \ ++ e_asin-fma \ ++ e_atan2-fma \ ++ e_exp-fma \ ++ e_log-fma \ ++ e_log2-fma \ ++ e_pow-fma \ ++ s_atan-fma \ ++ s_expm1-fma \ ++ s_log1p-fma \ ++ s_sin-fma \ ++ s_sincos-fma \ ++ s_tan-fma \ ++# libm-sysdep_routines + + CFLAGS-e_asin-fma.c = -mfma -mavx2 + CFLAGS-e_atan2-fma.c = -mfma -mavx2 + CFLAGS-e_exp-fma.c = -mfma -mavx2 + CFLAGS-e_log-fma.c = -mfma -mavx2 ++CFLAGS-e_log2-fma.c = -mfma -mavx2 + CFLAGS-e_pow-fma.c = -mfma -mavx2 + CFLAGS-s_atan-fma.c = -mfma -mavx2 ++CFLAGS-s_expm1-fma.c = -mfma -mavx2 ++CFLAGS-s_log1p-fma.c = -mfma -mavx2 + CFLAGS-s_sin-fma.c = -mfma -mavx2 + CFLAGS-s_tan-fma.c = -mfma -mavx2 + CFLAGS-s_sincos-fma.c = -mfma -mavx2 + +-libm-sysdep_routines += s_sinf-sse2 s_cosf-sse2 s_sincosf-sse2 ++libm-sysdep_routines += \ ++ s_cosf-sse2 \ ++ s_sincosf-sse2 \ ++ s_sinf-sse2 \ ++# libm-sysdep_routines + +-libm-sysdep_routines += e_exp2f-fma e_expf-fma e_log2f-fma e_logf-fma \ +- e_powf-fma s_sinf-fma s_cosf-fma s_sincosf-fma ++libm-sysdep_routines += \ ++ e_exp2f-fma \ ++ e_expf-fma \ ++ e_log2f-fma \ ++ e_logf-fma \ ++ e_powf-fma \ ++ s_cosf-fma \ ++ s_sincosf-fma \ ++ s_sinf-fma \ ++# libm-sysdep_routines + + CFLAGS-e_exp2f-fma.c = -mfma -mavx2 + CFLAGS-e_expf-fma.c = -mfma -mavx2 +@@ -37,9 +83,17 @@ CFLAGS-s_sinf-fma.c = -mfma -mavx2 + CFLAGS-s_cosf-fma.c = -mfma -mavx2 + CFLAGS-s_sincosf-fma.c = -mfma -mavx2 + +-libm-sysdep_routines += e_exp-fma4 e_log-fma4 e_pow-fma4 s_atan-fma4 \ +- e_asin-fma4 e_atan2-fma4 s_sin-fma4 s_tan-fma4 \ +- s_sincos-fma4 ++libm-sysdep_routines += \ ++ e_exp-fma4 \ ++ e_log-fma4 \ ++ e_pow-fma4 \ ++ e_asin-fma4 \ ++ s_atan-fma4 \ ++ e_atan2-fma4 \ ++ s_sin-fma4 \ ++ s_sincos-fma4 \ ++ s_tan-fma4 \ ++# libm-sysdep_routines + + CFLAGS-e_asin-fma4.c = -mfma4 + CFLAGS-e_atan2-fma4.c = -mfma4 +@@ -51,9 +105,15 @@ CFLAGS-s_sin-fma4.c = -mfma4 + CFLAGS-s_tan-fma4.c = -mfma4 + CFLAGS-s_sincos-fma4.c = -mfma4 + +-libm-sysdep_routines += e_exp-avx e_log-avx s_atan-avx \ +- e_atan2-avx s_sin-avx s_tan-avx \ +- s_sincos-avx ++libm-sysdep_routines += \ ++ e_exp-avx \ ++ e_log-avx \ ++ s_atan-avx \ ++ e_atan2-avx \ ++ s_sin-avx \ ++ s_sincos-avx \ ++ s_tan-avx \ ++# libm-sysdep_routines + + CFLAGS-e_atan2-avx.c = -msse2avx -DSSE2AVX + CFLAGS-e_exp-avx.c = -msse2avx -DSSE2AVX +diff --git a/sysdeps/x86_64/fpu/multiarch/e_log2-fma.c b/sysdeps/x86_64/fpu/multiarch/e_log2-fma.c +new file mode 100644 +index 0000000000..9fbebc1b47 +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/e_log2-fma.c +@@ -0,0 +1,3 @@ ++#define __log2 __log2_fma ++ ++#include <sysdeps/ieee754/dbl-64/e_log2.c> +diff --git a/sysdeps/x86_64/fpu/multiarch/e_log2.c b/sysdeps/x86_64/fpu/multiarch/e_log2.c +new file mode 100644 +index 0000000000..c0320caf36 +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/e_log2.c +@@ -0,0 +1,43 @@ ++/* Multiple versions of log2. ++ Copyright (C) 2023 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <libm-alias-double.h> ++#include <libm-alias-finite.h> ++ ++extern double __redirect_log2 (double); ++ ++#define SYMBOL_NAME log2 ++#include "ifunc-fma.h" ++ ++libc_ifunc_redirected (__redirect_log2, __log2, IFUNC_SELECTOR ()); ++ ++#ifdef SHARED ++__hidden_ver1 (__log2, __GI___log2, __redirect_log2) ++ __attribute__ ((visibility ("hidden"))); ++ ++versioned_symbol (libm, __ieee754_log2, log2, GLIBC_2_29); ++libm_alias_double_other (__log2, log2) ++#else ++libm_alias_double (__log2, log2) ++#endif ++ ++strong_alias (__log2, __ieee754_log2) ++libm_alias_finite (__log2, __log2) ++ ++#define __log2 __log2_sse2 ++#include <sysdeps/ieee754/dbl-64/e_log2.c> +diff --git a/sysdeps/x86_64/fpu/multiarch/s_expm1-fma.c b/sysdeps/x86_64/fpu/multiarch/s_expm1-fma.c +new file mode 100644 +index 0000000000..3ee2bd804e +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/s_expm1-fma.c +@@ -0,0 +1,10 @@ ++#define __expm1 __expm1_fma ++ ++/* NB: __expm1 may be expanded to __expm1_fma in the following ++ prototypes. */ ++extern long double __expm1l (long double); ++extern long double __expm1f128 (long double); ++ ++#define SECTION __attribute__ ((section (".text.fma"))) ++ ++#include <sysdeps/ieee754/dbl-64/s_expm1.c> +diff --git a/sysdeps/x86_64/fpu/multiarch/s_expm1.c b/sysdeps/x86_64/fpu/multiarch/s_expm1.c +new file mode 100644 +index 0000000000..2cae83fb7f +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/s_expm1.c +@@ -0,0 +1,36 @@ ++/* Multiple versions of expm1. ++ Copyright (C) 2023 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <libm-alias-double.h> ++ ++extern double __redirect_expm1 (double); ++ ++#define SYMBOL_NAME expm1 ++#include "ifunc-fma.h" ++ ++libc_ifunc_redirected (__redirect_expm1, __expm1, IFUNC_SELECTOR ()); ++libm_alias_double (__expm1, expm1) ++ ++#define __expm1 __expm1_sse2 ++ ++/* NB: __expm1 may be expanded to __expm1_sse2 in the following ++ prototypes. */ ++extern long double __expm1l (long double); ++extern long double __expm1f128 (long double); ++ ++#include <sysdeps/ieee754/dbl-64/s_expm1.c> +diff --git a/sysdeps/x86_64/fpu/multiarch/s_log1p-fma.c b/sysdeps/x86_64/fpu/multiarch/s_log1p-fma.c +new file mode 100644 +index 0000000000..8952df8f9e +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/s_log1p-fma.c +@@ -0,0 +1,4 @@ ++#define __log1p __log1p_fma ++#define SECTION __attribute__ ((section (".text.fma"))) ++ ++#include <sysdeps/ieee754/dbl-64/s_log1p.c> +diff --git a/sysdeps/x86_64/fpu/multiarch/s_log1p.c b/sysdeps/x86_64/fpu/multiarch/s_log1p.c +new file mode 100644 +index 0000000000..6ce5198d6d +--- /dev/null ++++ b/sysdeps/x86_64/fpu/multiarch/s_log1p.c +@@ -0,0 +1,29 @@ ++/* Multiple versions of log1p. ++ Copyright (C) 2023 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <libm-alias-double.h> ++ ++extern double __redirect_log1p (double); ++ ++#define SYMBOL_NAME log1p ++#include "ifunc-fma.h" ++ ++libc_ifunc_redirected (__redirect_log1p, __log1p, IFUNC_SELECTOR ()); ++ ++#define __log1p __log1p_sse2 ++#include <sysdeps/ieee754/dbl-64/s_log1p.c> diff --git a/sysdeps/x86_64/multiarch/ifunc-avx2.h b/sysdeps/x86_64/multiarch/ifunc-avx2.h index a57a9952f3..f2f5e8a211 100644 --- a/sysdeps/x86_64/multiarch/ifunc-avx2.h @@ -17630,6 +19296,19 @@ index afd450d020..51bc9344f0 100644 movzbl (VEC_SIZE * -1 + SIZE_OFFSET)(%rsi, %rax), %ecx movzbl (VEC_SIZE * -1 + SIZE_OFFSET)(%rdi, %rax), %eax subl %ecx, %eax +diff --git a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S +index 905d0fa464..bc4053d1c5 100644 +--- a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S ++++ b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S +@@ -301,7 +301,7 @@ L(more_2x_vec): + leaq (VEC_SIZE * 4)(%rax), %LOOP_REG + #endif + /* Align dst for loop. */ +- andq $(VEC_SIZE * -2), %LOOP_REG ++ andq $(VEC_SIZE * -1), %LOOP_REG + .p2align 4 + L(loop): + VMOVA %VEC(0), LOOP_4X_OFFSET(%LOOP_REG) diff --git a/sysdeps/x86_64/multiarch/rtld-strcpy.S b/sysdeps/x86_64/multiarch/rtld-strcpy.S new file mode 100644 index 0000000000..19439c553d
