commit 1f34ad592ba141b9c0b09c85b90c5e94cb989092 (HEAD -> gentoo/2.38)
Author: Charles Fol <folcharles@gmail.com>
Date:   Thu Mar 28 12:25:38 2024 -0300

    iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961)
    
    ISO-2022-CN-EXT uses escape sequences to indicate character set changes
    (as specified by RFC 1922).  While the SOdesignation has the expected
    bounds checks, neither SS2designation nor SS3designation have its;
    allowing a write overflow of 1, 2, or 3 bytes with fixed values:
    '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.
    
    Checked on aarch64-linux-gnu.
    
    Co-authored-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada)
    (cherry picked from commit e1135387deded5d73924f6ca20c72a35dc8e1bda)

 iconvdata/Makefile                    |   5 +-
 iconvdata/iso-2022-cn-ext.c           |  12 ++++
 iconvdata/tst-iconv-iso-2022-cn-ext.c | 128 ++++++++++++++++++++++++++++++++++
 3 files changed, 144 insertions(+), 1 deletion(-)

commit 741901d5967d4dea68b6a51fd65b8d463af4d1b9
Author: Florian Weimer <fweimer@redhat.com>
Date:   Sun Apr 14 08:24:51 2024 +0200

    powerpc: Fix ld.so address determination for PCREL mode (bug 31640)
    
    This seems to have stopped working with some GCC 14 versions,
    which clobber r2.  With other compilers, the kernel-provided
    r2 value is still available at this point.
    
    Reviewed-by: Peter Bergner <bergner@linux.ibm.com>
    (cherry picked from commit 14e56bd4ce15ac2d1cc43f762eb2e6b83fec1afe)
    (cherry picked from commit 20534f81760635f3a71fb11ba251568cdc11c6a0)

 sysdeps/powerpc/powerpc64/dl-machine.h | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

commit 97f2bb268db0f5f19b9f2b92ca40f81821d1af15
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Thu Mar 21 16:48:33 2024 +0000

    AArch64: Check kernel version for SVE ifuncs
    
    Old Linux kernels disable SVE after every system call.  Calling the
    SVE-optimized memcpy afterwards will then cause a trap to reenable SVE.
    As a result, applications with a high use of syscalls may run slower with
    the SVE memcpy.  This is true for kernels between 4.15.0 and before 6.2.0,
    except for 5.14.0 which was patched.  Avoid this by checking the kernel
    version and selecting the SVE ifunc on modern kernels.
    
    Parse the kernel version reported by uname() into a 24-bit kernel.major.minor
    value without calling any library functions.  If uname() is not supported or
    if the version format is not recognized, assume the kernel is modern.
    
    Tested-by: Florian Weimer <fweimer@redhat.com>
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 2e94e2f5d2bf2de124c8ad7da85463355e54ccb2)
    (cherry picked from commit 92da7c2cfeeea36d651142f47e570dd5076bc166)

 sysdeps/aarch64/multiarch/init-arch.h          |  2 ++
 sysdeps/aarch64/multiarch/memcpy.c             |  2 +-
 sysdeps/aarch64/multiarch/memmove.c            |  2 +-
 sysdeps/unix/sysv/linux/aarch64/cpu-features.c | 48 ++++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/aarch64/cpu-features.h |  1 +
 5 files changed, 53 insertions(+), 2 deletions(-)

commit e26cf93c21fe747dbc9a0324ebcf0b9e8561a9e1
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Wed Mar 13 14:34:14 2024 +0000

    aarch64: fix check for SVE support in assembler
    
    Due to GCC bug 110901 -mcpu can override -march setting when compiling
    asm code and thus a compiler targetting a specific cpu can fail the
    configure check even when binutils gas supports SVE.
    
    The workaround is that explicit .arch directive overrides both -mcpu
    and -march, and since that's what the actual SVE memcpy uses the
    configure check should use that too even if the GCC issue is fixed
    independently.
    
    Reviewed-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 73c26018ed0ecd9c807bb363cc2c2ab4aca66a82)
    (cherry picked from commit 1bf17ce978da71431dbd1fc3660cfae3dff0672f)

 sysdeps/aarch64/configure    | 5 +++--
 sysdeps/aarch64/configure.ac | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

commit 1cef1262c7557c4cebd1272d3cdf71caca64cda7
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu Nov 23 18:23:46 2023 +0100

    aarch64: correct CFI in rawmemchr (bug 31113)
    
    The .cfi_return_column directive changes the return column for the whole
    FDE range.  But the actual intent is to tell the unwinder that the value
    in x30 (lr) now resides in x15 after the move, and that is expressed by
    the .cfi_register directive.
    
    (cherry picked from commit 3f798427884fa57770e8e2291cf58d5918254bb5)
    (cherry picked from commit 168ae58e6e705a53a71850ee63ba5514fd5d7b70)

 sysdeps/aarch64/rawmemchr.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 1933f20a53a30459fc54d4c3a7dd19469f17834d
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Thu Oct 26 17:30:36 2023 +0100

    AArch64: Remove Falkor memcpy
    
    The latest implementations of memcpy are actually faster than the Falkor
    implementations [1], so remove the falkor/phecda ifuncs for memcpy and
    the now unused IS_FALKOR/IS_PHECDA defines.
    
    [1] https://sourceware.org/pipermail/libc-alpha/2022-December/144227.html
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 2f5524cc5381eb75fef55f7901bb907bd5628333)
    (cherry picked from commit a08ff922946dca0303a270bbfa2557f74caa47aa)

 manual/tunables.texi                           |   2 +-
 sysdeps/aarch64/multiarch/Makefile             |   1 -
 sysdeps/aarch64/multiarch/ifunc-impl-list.c    |   2 -
 sysdeps/aarch64/multiarch/memcpy.c             |   4 -
 sysdeps/aarch64/multiarch/memcpy_falkor.S      | 313 -------------------------
 sysdeps/aarch64/multiarch/memmove.c            |   4 -
 sysdeps/unix/sysv/linux/aarch64/cpu-features.c |   2 -
 sysdeps/unix/sysv/linux/aarch64/cpu-features.h |   5 -
 8 files changed, 1 insertion(+), 332 deletions(-)

commit d14fdcbd12ad2a9e13072f92ed9693a8e60f9f0b
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Thu Oct 26 17:07:21 2023 +0100

    AArch64: Add memset_zva64
    
    Add a specialized memset for the common ZVA size of 64 to avoid the
    overhead of reading the ZVA size.  Since the code is identical to
    __memset_falkor, remove the latter.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 3d7090f14b13312320e425b27dcf0fe72de026fd)
    (cherry picked from commit 156e44845f4137d6d3ea6c2824dd459652a7efda)

 sysdeps/aarch64/memset.S                    | 10 +++---
 sysdeps/aarch64/multiarch/Makefile          |  2 +-
 sysdeps/aarch64/multiarch/ifunc-impl-list.c |  4 +--
 sysdeps/aarch64/multiarch/memset.c          |  9 +++--
 sysdeps/aarch64/multiarch/memset_falkor.S   | 54 -----------------------------
 sysdeps/aarch64/multiarch/memset_zva64.S    | 27 +++++++++++++++
 6 files changed, 38 insertions(+), 68 deletions(-)

commit 363e1230af3e5d50a49d85c39cb467c66fb3e9b1
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Thu Oct 26 16:34:47 2023 +0100

    AArch64: Cleanup emag memset
    
    Cleanup emag memset - merge the memset_base64.S file, remove
    the unused ZVA code (since it is disabled on emag).
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 9627ab99b50d250c6dd3001a3355aa03692f7fe5)
    (cherry picked from commit 1521237c3211bb0b1a8f7a9c5793d382789b2b68)

 sysdeps/aarch64/multiarch/ifunc-impl-list.c |   2 +-
 sysdeps/aarch64/multiarch/memset.c          |   2 +-
 sysdeps/aarch64/multiarch/memset_base64.S   | 185 ----------------------------
 sysdeps/aarch64/multiarch/memset_emag.S     |  98 +++++++++++++--
 4 files changed, 90 insertions(+), 197 deletions(-)

commit ec2df890af4bed00575725f8c09c97a205fcc725
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Tue Oct 24 13:51:07 2023 +0100

    AArch64: Cleanup ifuncs
    
    Cleanup ifuncs.  Remove uses of libc_hidden_builtin_def, use ENTRY rather than
    ENTRY_ALIGN, remove unnecessary defines and conditional compilation.  Rename
    strlen_mte to strlen_generic.  Remove rtld-memset.
    
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 9fd3409842b3e2d31cff5dbd6f96066c430f0aa2)
    (cherry picked from commit 25b66e8c4a75b51b0122089cf6b99860fb05470d)

 sysdeps/aarch64/memset.S                           |  2 +-
 sysdeps/aarch64/multiarch/Makefile                 |  2 +-
 sysdeps/aarch64/multiarch/ifunc-impl-list.c        |  2 +-
 sysdeps/aarch64/multiarch/memchr_nosimd.S          |  9 ++-----
 sysdeps/aarch64/multiarch/memcpy_a64fx.S           | 14 ++++-------
 sysdeps/aarch64/multiarch/memcpy_falkor.S          |  6 ++---
 sysdeps/aarch64/multiarch/memcpy_sve.S             |  2 --
 sysdeps/aarch64/multiarch/memcpy_thunderx.S        | 27 ++++-----------------
 sysdeps/aarch64/multiarch/memcpy_thunderx2.S       | 28 ++++------------------
 sysdeps/aarch64/multiarch/memset_a64fx.S           |  8 ++-----
 sysdeps/aarch64/multiarch/memset_base64.S          |  3 +--
 sysdeps/aarch64/multiarch/memset_emag.S            |  8 +++----
 sysdeps/aarch64/multiarch/memset_generic.S         |  8 ++++++-
 sysdeps/aarch64/multiarch/memset_kunpeng.S         |  9 ++-----
 sysdeps/aarch64/multiarch/rtld-memset.S            | 25 -------------------
 sysdeps/aarch64/multiarch/strlen.c                 |  4 ++--
 sysdeps/aarch64/multiarch/strlen_asimd.S           |  1 -
 .../multiarch/{strlen_mte.S => strlen_generic.S}   |  8 +++----
 18 files changed, 41 insertions(+), 125 deletions(-)

commit afcd62b16ac563d1787b053088aeaa65087d7e40
Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date:   Tue Oct 17 16:54:21 2023 +0100

    AArch64: Add support for MOPS memcpy/memmove/memset
    
    Add support for MOPS in cpu_features and INIT_ARCH.  Add ifuncs using MOPS for
    memcpy, memmove and memset (use .inst for now so it works with all binutils
    versions without needing complex configure and conditional compilation).
    
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 2bd00179885928fd95fcabfafc50e7b5c6e660d2)
    (cherry picked from commit d8a2b56b4fdf39488eb8a94f8b1064e262708b6f)

 sysdeps/aarch64/multiarch/Makefile             |  3 ++
 sysdeps/aarch64/multiarch/ifunc-impl-list.c    |  3 ++
 sysdeps/aarch64/multiarch/init-arch.h          |  4 ++-
 sysdeps/aarch64/multiarch/memcpy.c             |  4 +++
 sysdeps/aarch64/multiarch/memcpy_mops.S        | 39 ++++++++++++++++++++++++++
 sysdeps/aarch64/multiarch/memmove.c            |  4 +++
 sysdeps/aarch64/multiarch/memmove_mops.S       | 39 ++++++++++++++++++++++++++
 sysdeps/aarch64/multiarch/memset.c             |  4 +++
 sysdeps/aarch64/multiarch/memset_mops.S        | 38 +++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/aarch64/cpu-features.c |  3 ++
 sysdeps/unix/sysv/linux/aarch64/cpu-features.h |  1 +
 11 files changed, 141 insertions(+), 1 deletion(-)

commit 04182a3e8e06de553a61e3dce0afdaacb460b23a
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Oct 17 13:13:27 2023 +0000

    Add HWCAP2_MOPS from Linux 6.5 to AArch64 bits/hwcap.h
    
    Linux 6.5 adds a new AArch64 HWCAP2 value, HWCAP2_MOPS.  Add it to
    glibc's bits/hwcap.h.
    
    Tested with build-many-glibcs.py for aarch64-linux-gnu.
    
    (cherry picked from commit ff5d2abd18629e0efac41e31699cdff3be0e08fa)
    (cherry picked from commit 5456ff5d80e45741a73cf9fa792d789a1ed17a09)

 sysdeps/unix/sysv/linux/aarch64/bits/hwcap.h | 1 +
 1 file changed, 1 insertion(+)

commit ea9e2a3108d51d445ea4bd8d6a7ef2d3d4fb167f
Author: caiyinyu <caiyinyu@loongson.cn>
Date:   Mon Mar 11 16:07:48 2024 +0800

    LoongArch: Correct {__ieee754, _}_scalb -> {__ieee754, _}_scalbf
    
    (cherry picked from commit 0518bb0c16cb5986aaf35cf5e634964d7a06978b)

 sysdeps/loongarch/fpu/e_scalbf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 30d6cf2c4ab735ed1273b84ea8ef24f8f9d2aba5
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Mar 15 19:08:24 2024 +0100

    linux: Use rseq area unconditionally in sched_getcpu (bug 31479)
    
    Originally, nptl/descr.h included <sys/rseq.h>, but we removed that
    in commit 2c6b4b272e6b4d07303af25709051c3e96288f2d ("nptl:
    Unconditionally use a 32-byte rseq area").  After that, it was
    not ensured that the RSEQ_SIG macro was defined during sched_getcpu.c
    compilation that provided a definition.  This commit always checks
    the rseq area for CPU number information before using the other
    approaches.
    
    This adds an unnecessary (but well-predictable) branch on
    architectures which do not define RSEQ_SIG, but its cost is small
    compared to the system call.  Most architectures that have vDSO
    acceleration for getcpu also have rseq support.
    
    Fixes: 2c6b4b272e6b4d07303af25709051c3e96288f2d
    Fixes: 1d350aa06091211863e41169729cee1bca39f72f
    Reviewed-by: Arjun Shankar <arjun@redhat.com>
    (cherry picked from commit 7a76f218677d149d8b7875b336722108239f7ee9)
    (cherry picked from commit 5753cda1ca0749002c4718122a9b6d5177087b7b)

 sysdeps/unix/sysv/linux/sched_getcpu.c | 8 --------
 1 file changed, 8 deletions(-)

commit 22c8571e883080a2a02541eeb616d97711960214
Author: Stefan Liebler <stli@linux.ibm.com>
Date:   Thu Feb 22 15:03:27 2024 +0100

    S390: Do not clobber r7 in clone [BZ #31402]
    
    Starting with commit e57d8fc97b90127de4ed3e3a9cdf663667580935
    "S390: Always use svc 0"
    clone clobbers the call-saved register r7 in error case:
    function or stack is NULL.
    
    This patch restores the saved registers also in the error case.
    Furthermore the existing test misc/tst-clone is extended to check
    all error cases and that clone does not clobber registers in this
    error case.
    
    (cherry picked from commit 02782fd12849b6673cb5c2728cb750e8ec295aa3)
    Note: Added ia64 __clone2 call to tst-clone.c.
    (cherry picked from commit ee4806e978467d705b26ccb7dfddb9e0a710f8e4)

 sysdeps/unix/sysv/linux/s390/s390-32/clone.S |  1 +
 sysdeps/unix/sysv/linux/s390/s390-64/clone.S |  1 +
 sysdeps/unix/sysv/linux/tst-clone.c          | 76 +++++++++++++++++++++++-----
 3 files changed, 65 insertions(+), 13 deletions(-)

commit 4f4110e09221f78bda41b3f7e7fca6adb83a2f92 (tag: gentoo/glibc-2.38-11, gentoo/gentoo/2.38)
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Oct 11 13:43:56 2023 -0300

    malloc: Use __get_nprocs on arena_get2 (BZ 30945)
    
    This restore the 2.33 semantic for arena_get2.  It was changed by
    11a02b035b46 to avoid arena_get2 call malloc (back when __get_nproc
    was refactored to use an scratch_buffer - 903bc7dcc2acafc).  The
    __get_nproc was refactored over then and now it also avoid to call
    malloc.
    
    The 11a02b035b46 did not take in consideration any performance
    implication, which should have been discussed properly.  The
    __get_nprocs_sched is still used as a fallback mechanism if procfs
    and sysfs is not acessible.
    
    Checked on x86_64-linux-gnu.
    Reviewed-by: DJ Delorie <dj@redhat.com>
    
    (cherry picked from commit 472894d2cfee5751b44c0aaa71ed87df81c8e62e)
    (cherry picked from commit 506e47da1d66b33e24440a495eeef85daf7f2a78)

 include/sys/sysinfo.h                 | 4 ----
 malloc/arena.c                        | 2 +-
 misc/getsysstats.c                    | 6 ------
 sysdeps/mach/getsysstats.c            | 6 ------
 sysdeps/unix/sysv/linux/getsysstats.c | 2 +-
 5 files changed, 2 insertions(+), 18 deletions(-)

commit 69f121bae0f64d8631cd48c302280375d8aa30fc
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Feb 5 16:10:24 2024 +0000

    arm: Remove wrong ldr from _dl_start_user (BZ 31339)
    
    The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove
    _dl_skip_args usage) removed the _SKIP_ARGS literal, which was
    previously loader to r4 on loader _start.  However, the cleanup did not
    remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check
    to skip the arguments after ld self-relocations.
    
    In my testing, the kernel initially set r4 to 0, which makes the
    ldr instruction just read the _GLOBAL_OFFSET_TABLE_.  However, since r4
    is a callee-saved register; a different runtime might not zero
    initialize it and thus trigger an invalid memory access.
    
    Checked on arm-linux-gnu.
    
    Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com>
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a)
    (cherry picked from commit b09073e63138ce409bf6426cf820eeaa0d28ca74)

 sysdeps/arm/dl-machine.h | 1 -
 1 file changed, 1 deletion(-)

commit 6313d8c1ea48d023873d8b4922e080c64e84c905
Author: Daniel Cederman <cederman@gaisler.com>
Date:   Tue Jan 16 09:31:41 2024 +0100

    sparc: Remove unwind information from signal return stubs [BZ #31244]
    
    The functions were previously written in C, but were not compiled
    with unwind information. The ENTRY/END macros includes .cfi_startproc
    and .cfi_endproc which adds unwind information. This caused the
    tests cleanup-8 and cleanup-10 in the GCC testsuite to fail.
    This patch adds a version of the ENTRY/END macros without the
    CFI instructions that can be used instead.
    
    sigaction registers a restorer address that is located two instructions
    before the stub function. This patch adds a two instruction padding to
    avoid that the unwinder accesses the unwind information from the function
    that the linker has placed right before it in memory. This fixes an issue
    with pthread_cancel that caused tst-mutex8-static (and other tests) to fail.
    
    Signed-off-by: Daniel Cederman <cederman@gaisler.com>
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 7bd06985c0a143cdcba2762bfe020e53514a53de)
    (cherry picked from commit 0c5e5bace57578ed3e28eb89ee2d2b31b74c4ecc)

 sysdeps/sparc/sysdep.h                                 |  9 +++++++++
 sysdeps/unix/sysv/linux/sparc/sparc32/sigreturn_stub.S | 11 +++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

commit 48e764d7d46685b4d9f6fa34c2405992c4cbb97c
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Jan 18 10:52:18 2024 -0300

    sparc: Fix sparc64 memmove length comparison (BZ 31266)
    
    The small counts copy bytes comparsion should be unsigned (as the
    memmove size argument).  It fixes string/tst-memmove-overflow on
    sparcv9, where the input size triggers an invalid code path.
    
    Checked on sparc64-linux-gnu and sparcv9-linux-gnu.
    
    (cherry picked from commit 926a4bdbb5fc8955570208b5571b2d04c6ffbd1d)
    (cherry picked from commit aac57faf5425b472a72132b09f4b3a2aa1f77a63)

 sysdeps/sparc/sparc64/memmove.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 69ac80bc58e10d8d2ed51e5365aec35734d746c4
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Jan 17 10:38:09 2024 -0300

    sparc64: Remove unwind information from signal return stubs [BZ#31244]
    
    Similar to sparc32 fix, remove the unwind information on the signal
    return stubs.  This fixes the regressions:
    
    FAIL: nptl/tst-cancel24-static
    FAIL: nptl/tst-cond8-static
    FAIL: nptl/tst-mutex8-static
    FAIL: nptl/tst-mutexpi8-static
    FAIL: nptl/tst-mutexpi9
    
    On sparc64-linux-gnu.
    
    (cherry picked from commit 369efd817780276dbe0ecf8be6e1f354bdbc9857)
    (cherry picked from commit 0e383d2d4e7c08b36ad3edb30c072a3dc4d26ed8)

 sysdeps/unix/sysv/linux/sparc/sparc64/sigreturn_stub.S | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

commit e44b1139ae75dc2952a11430bd2725506849ca8a
Author: Andreas Larsson <andreas@gaisler.com>
Date:   Wed Nov 15 13:29:43 2023 +0100

    sparc: Fix broken memset for sparc32 [BZ #31068]
    
    Fixes commit a61933fe27df ("sparc: Remove bzero optimization") that
    after moving code jumped to the wrong label 4.
    
    Verfied by successfully running string/test-memset on sparc32.
    
    Signed-off-by: Andreas Larsson <andreas@gaisler.com>
    Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 578190b7e43305141512dee777e4a3b3e8159393)
    (cherry picked from commit 6f68075869f6034f5fde3823741623d34164dc7d)

 sysdeps/sparc/sparc32/memset.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 3ba31b9a97c0d5c3e5726be603fcc4d4155d4dfe
Author: Stefan Liebler <stli@linux.ibm.com>
Date:   Tue Jan 30 09:34:32 2024 +0100

    S390: Fix building with --disable-mutli-arch [BZ #31196]
    
    Starting with commits
    - 7ea510127e2067efa07865158ac92c330c379950
    string: Add libc_hidden_proto for strchrnul
    - 22999b2f0fb62eed1af4095d062bd1272d6afeb1
    string: Add libc_hidden_proto for memrchr
    
    building glibc on s390x with --disable-multi-arch fails if only
    the C-variant of strchrnul / memrchr is used.  This is the case
    if gcc uses -march < z13.
    
    The build fails with:
    ../sysdeps/s390/strchrnul-c.c:28:49: error: ‘__strchrnul_c’ undeclared here (not in a function); did you mean ‘__strchrnul’?
       28 | __hidden_ver1 (__strchrnul_c, __GI___strchrnul, __strchrnul_c);
    
    With --disable-multi-arch, __strchrnul_c is not available as string/strchrnul.c
    is just included without defining STRCHRNUL and thus we also don't have to create
    the internal hidden symbol.
    
    Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
    (cherry picked from commit cc1b91eabd806057aa7e3058a84bf129ed36e157)
    (cherry picked from commit 18876c9ff52c3d9aefe2c663b1a287589bebedc0)

 sysdeps/s390/memrchr-c.c   | 4 +++-
 sysdeps/s390/strchrnul-c.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

commit b78133df2eaf0d639094b5ceeade8ef6cd567b2c
Author: Sunil K Pandey <skpgkp2@gmail.com>
Date:   Wed Jul 26 08:34:05 2023 -0700

    x86_64: Optimize ffsll function code size.
    
    Ffsll function randomly regress by ~20%, depending on how code gets
    aligned in memory.  Ffsll function code size is 17 bytes.  Since default
    function alignment is 16 bytes, it can load on 16, 32, 48 or 64 bytes
    aligned memory.  When ffsll function load at 16, 32 or 64 bytes aligned
    memory, entire code fits in single 64 bytes cache line.  When ffsll
    function load at 48 bytes aligned memory, it splits in two cache line,
    hence random regression.
    
    Ffsll function size reduction from 17 bytes to 12 bytes ensures that it
    will always fit in single 64 bytes cache line.
    
    This patch fixes ffsll function random performance regression.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 9d94997b5f9445afd4f2bccc5fa60ff7c4361ec1)
    (cherry picked from commit 30e546d76e756fe4d2d20a8b2286de4fbf30ceb5)

 sysdeps/x86_64/ffsll.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

commit e2218c420f1aca6c8910f4ddd6df11815c137bdf
Author: Michael Karcher <sourceware-bugzilla@mkarcher.dialup.fu-berlin.de>
Date:   Sat Feb 17 22:47:58 2024 +0100

    Mitigation for "clone on sparc might fail with -EFAULT for no valid reason"
    
    Bug: https://www.mail-archive.com/debian-glibc@lists.debian.org/msg62592.html
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
    See-also: https://lore.kernel.org/sparclinux/62f9be9d-a086-4134-9a9f-5df8822708af@mkarcher.dialup.fu-berlin.de/
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
    (cherry picked from commit fa441cd6be9a34d81306d41defeefaa2ac31d0b8)

 sysdeps/unix/sysv/linux/sparc/sparc32/clone.S | 3 +++
 sysdeps/unix/sysv/linux/sparc/sparc64/clone.S | 3 +++
 2 files changed, 6 insertions(+)

commit 9f9d77d451dd22832d1e83e1c06245995e963885
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Feb 16 07:40:37 2024 +0100

    i386: Use generic memrchr in libc (bug 31316)
    
    Before this change, we incorrectly used the SSE2 variant in the
    implementation, without checking that the system actually supports
    SSE2.
    
    Tested-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 0d9166c2245cad4ac520b337dee40c9a583872b6)

 sysdeps/i386/i686/multiarch/memrchr-c.c    | 1 +
 sysdeps/i386/i686/multiarch/memrchr-sse2.S | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

commit fd6a0404c3245451a264751a5b4b988370215c2a (tag: gentoo/glibc-2.38-10)
Author: Arjun Shankar <arjun@redhat.com>
Date:   Mon Jan 15 17:44:45 2024 +0100

    syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
    
    __vsyslog_internal calculated a buffer size by adding two integers, but
    did not first check if the addition would overflow.  This commit fixes
    that.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b)
    (cherry picked from commit d37c2b20a4787463d192b32041c3406c2bd91de0)

 misc/syslog.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

commit 2b8c1a4b7581822263f6d6498ab82991d16fa4f7
Author: Arjun Shankar <arjun@redhat.com>
Date:   Mon Jan 15 17:44:44 2024 +0100

    syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
    
    __vsyslog_internal used the return value of snprintf/vsnprintf to
    calculate buffer sizes for memory allocation.  If these functions (for
    any reason) failed and returned -1, the resulting buffer would be too
    small to hold output.  This commit fixes that.
    
    All snprintf/vsnprintf calls are checked for negative return values and
    the function silently returns upon encountering them.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 7e5a0c286da33159d47d0122007aac016f3e02cd)
    (cherry picked from commit d0338312aace5bbfef85e03055e1212dd0e49578)

 misc/syslog.c | 39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

commit fc928af114154282c402222fad0d5ade87f7a235
Author: Arjun Shankar <arjun@redhat.com>
Date:   Mon Jan 15 17:44:43 2024 +0100

    syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
    
    __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
    containing a long program name failed to update the required buffer
    size, leading to the allocation and overflow of a too-small buffer on
    the heap.  This commit fixes that.  It also adds a new regression test
    that uses glibc.malloc.check.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 6bd0e4efcc78f3c0115e5ea9739a1642807450da)
    (cherry picked from commit 23514c72b780f3da097ecf33a793b7ba9c2070d2)

 misc/Makefile                                    |  8 +++-
 misc/syslog.c                                    | 50 +++++++++++++++++-------
 misc/tst-syslog-long-progname.c                  | 39 ++++++++++++++++++
 misc/tst-syslog-long-progname.root/postclean.req |  0
 4 files changed, 82 insertions(+), 15 deletions(-)

commit 33c5167b00c38bb6a4db599f079600eb45b51bd0
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Jan 2 14:36:17 2024 +0100

    libio: Check remaining buffer size in _IO_wdo_write (bug 31183)
    
    The multibyte character needs to fit into the remaining buffer space,
    not the already-written buffer space.  Without the fix, we were never
    moving the write pointer from the start of the buffer, always using
    the single-character fallback buffer.
    
    Fixes commit 04b76b5aa8b2d1d19066e42dd1 ("Don't error out writing
    a multibyte character to an unbuffered stream (bug 17522)").
    
    (cherry picked from commit ecc7c3deb9f347649c2078fcc0f94d4cedf92d60)
    (cherry picked from commit cfe121910013a46e2477562282c56ae8062089aa)

 NEWS             | 1 +
 libio/wfileops.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

commit 67f31cb19badf11997a11c8b42ca45e3c3bd1bfc
Author: Andreas Schwab <schwab@suse.de>
Date:   Wed Dec 6 14:48:22 2023 +0100

    getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163)
    
    When __resolv_context_get returns NULL due to out of memory, translate it
    to a return value of EAI_MEMORY.
    
    (cherry picked from commit 5eabdb6a6ac1599d23dd5966a37417215950245f)
    (cherry picked from commit ae1e5217021e43e1f2de443d26e87ea3adfb221c)

 sysdeps/posix/getaddrinfo.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

commit d63e3913e62114f4fc71862f2d57b454a5746a24 (tag: gentoo/glibc-2.38-9)
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Dec 23 22:56:11 2023 +0100

    Gentoo: Disable valgrind-based tests, too unreliable
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 elf/Makefile | 4 ----
 1 file changed, 4 deletions(-)

commit 4e63cde2006aa3a2587a3504ba6eb23818b96e17 (tag: gentoo/glibc-2.38-8)
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sat Dec 23 06:27:50 2023 -0800

    NEWS: Mention bug fixes for 30745/30843
    
    (cherry picked from commit 27339a3eb8f987eebae72b854af80256c1588ebd)

 NEWS | 2 ++
 1 file changed, 2 insertions(+)

commit 8acd4548a73c47dc0f9a43749792e75719e1d361
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sat Dec 23 06:24:41 2023 -0800

    NEWS: Mention bug fixes for 29039/30694/30709/30721
    
    (cherry picked from commit d25e2c8d5cb0778ae87ad43b1f4c301abe5a932b)

 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

commit 7bffa27ca9bd890b0b6df5f489e8f14789f5542b
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Dec 20 19:42:12 2023 -0800

    x86-64: Fix the tcb field load for x32 [BZ #31185]
    
    _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic access the thread pointer
    via the tcb field in TCB:
    
    _dl_tlsdesc_undefweak:
            _CET_ENDBR
            movq    8(%rax), %rax
            subq    %fs:0, %rax
            ret
    
    _dl_tlsdesc_dynamic:
            ...
            subq    %fs:0, %rax
            movq    -8(%rsp), %rdi
            ret
    
    Since the tcb field in TCB is a pointer, %fs:0 is a 32-bit location,
    not 64-bit. It should use "sub %fs:0, %RAX_LP" instead.  Since
    _dl_tlsdesc_undefweak returns ptrdiff_t and _dl_make_tlsdesc_dynamic
    returns void *, RAX_LP is appropriate here for x32 and x86-64.  This
    fixes BZ #31185.
    
    (cherry picked from commit 81be2a61dafc168327c1639e97b6dae128c7ccf3)
    (cherry picked from commit 968c983d43bc51f719f3e7a0fcb1bb8669b5f7c4)

 NEWS                        | 1 +
 sysdeps/x86_64/dl-tlsdesc.S | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

commit 285f121e8bd1f95676908306b66b7f4a65087508
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Dec 20 16:31:43 2023 -0800

    x86-64: Fix the dtv field load for x32 [BZ #31184]
    
    On x32, I got
    
    FAIL: elf/tst-tlsgap
    
    $ gdb elf/tst-tlsgap
    ...
    open tst-tlsgap-mod1.so
    
    Thread 2 "tst-tlsgap" received signal SIGSEGV, Segmentation fault.
    [Switching to LWP 2268754]
    _dl_tlsdesc_dynamic () at ../sysdeps/x86_64/dl-tlsdesc.S:108
    108             movq    (%rsi), %rax
    (gdb) p/x $rsi
    $4 = 0xf7dbf9005655fb18
    (gdb)
    
    This is caused by
    
    _dl_tlsdesc_dynamic:
            _CET_ENDBR
            /* Preserve call-clobbered registers that we modify.
               We need two scratch regs anyway.  */
            movq    %rsi, -16(%rsp)
            movq    %fs:DTV_OFFSET, %rsi
    
    Since the dtv field in TCB is a pointer, %fs:DTV_OFFSET is a 32-bit
    location, not 64-bit.  Load the dtv field to RSI_LP instead of rsi.
    This fixes BZ #31184.
    
    (cherry picked from commit 3502440397bbb840e2f7223734aa5cc2cc0e29b6)
    (cherry picked from commit 35ea7549751d4f13a28c732e6ad68204f5e60a06)

 NEWS                        | 1 +
 sysdeps/x86_64/dl-tlsdesc.S | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

commit 37b1196f03be1875ebe64c51857134c1e9c3746a
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Wed Nov 29 11:31:37 2023 +0000

    elf: Add TLS modid reuse test for bug 29039
    
    This is a minimal regression test for bug 29039 which only affects
    targets with TLSDESC and a reproducer requires that
    
    1) Have modid gaps (closed modules) with old generation.
    2) Update a DTV to a newer generation (needs a newer dlopen).
    3) But do not update the closed gap entry in that DTV.
    4) Reuse the modid gap for a new module (another dlopen).
    5) Use dynamic TLSDESC in that new module with old generation (bug).
    6) Access TLS via this TLSDESC and the now outdated DTV.
    
    However step (3) in practice rarely happens: during DTV update the
    entries for closed modids are initialized to "unallocated" and then
    dynamic TLSDESC calls __tls_get_addr independently of its generation.
    The only exception to this is DTV setup at thread creation (gaps are
    initialized to NULL instead of unallocated) or DTV resize where the
    gap entries are outside the previous DTV array (again NULL instead
    of unallocated, and this requires loading > DTV_SURPLUS modules).
    
    So the bug can only cause NULL (+ offset) dereference, not use after
    free. And the easiest way to get (3) is via thread creation.
    
    Note that step (5) requires that the newly loaded module has larger
    TLS than the remaining optional static TLS. And for (6) there cannot
    be other TLS access or dlopen in the thread that updates the DTV.
    
    Tested on aarch64-linux-gnu.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 980450f12685326729d63ff72e93a996113bf073)
    (cherry picked from commit 0de9082ed8d8f149ca87d569a73692046e236c18)

 elf/Makefile          | 15 +++++++++
 elf/tst-tlsgap-mod0.c |  2 ++
 elf/tst-tlsgap-mod1.c |  2 ++
 elf/tst-tlsgap-mod2.c |  2 ++
 elf/tst-tlsgap.c      | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 113 insertions(+)

commit 4a52cba5dec955ca8a41534dfcfc8904b985935c
Author: Hector Martin <marcan@marcan.st>
Date:   Tue Nov 28 15:23:07 2023 +0900

    elf: Fix TLS modid reuse generation assignment (BZ 29039)
    
    _dl_assign_tls_modid() assigns a slotinfo entry for a new module, but
    does *not* do anything to the generation counter. The first time this
    happens, the generation is zero and map_generation() returns the current
    generation to be used during relocation processing. However, if
    a slotinfo entry is later reused, it will already have a generation
    assigned. If this generation has fallen behind the current global max
    generation, then this causes an obsolete generation to be assigned
    during relocation processing, as map_generation() returns this
    generation if nonzero. _dl_add_to_slotinfo() eventually resets the
    generation, but by then it is too late. This causes DTV updates to be
    skipped, leading to NULL or broken TLS slot pointers and segfaults.
    
    Fix this by resetting the generation to zero in _dl_assign_tls_modid(),
    so it behaves the same as the first time a slot is assigned.
    _dl_add_to_slotinfo() will still assign the correct static generation
    later during module load, but relocation processing will no longer use
    an obsolete generation.
    
    Note that slotinfo entry (aka modid) reuse typically happens after a
    dlclose and only TLS access via dynamic tlsdesc is affected. Because
    tlsdesc is optimized to use the optional part of static TLS, dynamic
    tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls
    tunable to a large enough value, or by LD_PRELOAD-ing the affected
    modules.
    
    Fixes bug 29039.
    
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 3921c5b40f293c57cb326f58713c924b0662ef59)
    (cherry picked from commit ccdc4cba07684fe1397e1f5f134a0a827af98c04)

 elf/dl-tls.c | 1 +
 1 file changed, 1 insertion(+)

commit fb2e7343399bb51c3f173006e80077762695747a
Author: caiyinyu <caiyinyu@loongson.cn>
Date:   Thu Oct 26 17:27:21 2023 +0800

    LoongArch: Delete excessively allocated memory.
    
    Backported from glibc 2.39 development.
    
    (cherry picked from commit 44f757a6364a546359809d48c76b3debd26e77d4)

 sysdeps/loongarch/dl-trampoline.h | 68 +++++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

commit 391a0d5ef89c0f7b252e7ece218a93da476d3b5c
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Dec 7 11:17:35 2023 -0300

    elf: Fix wrong break removal from 8ee878592c
    
    Reported-by: Alexander Monakov <amonakov@ispras.ru>
    (cherry picked from commit 546a1ba664626603660b595662249d524e429013)
    (cherry picked from commit bf5aa419cbf545d2cd09dc097e518033d6e4df5e)

 elf/readelflib.c | 1 +
 1 file changed, 1 insertion(+)

commit 6551218a6ec42db70ebe0e62e9b79bc9e7a65155
Author: Sergio Durigan Junior <sergiodj@sergiodj.net>
Date:   Wed Nov 1 18:15:23 2023 -0400

    sysdeps: sem_open: Clear O_CREAT when semaphore file is expected to exist [BZ #30789]
    
    When invoking sem_open with O_CREAT as one of its flags, we'll end up
    in the second part of sem_open's "if ((oflag & O_CREAT) == 0 || (oflag
    & O_EXCL) == 0)", which means that we don't expect the semaphore file
    to exist.
    
    In that part, open_flags is initialized as "O_RDWR | O_CREAT | O_EXCL
    | O_CLOEXEC" and there's an attempt to open(2) the file, which will
    likely fail because it won't exist.  After that first (expected)
    failure, some cleanup is done and we go back to the label "try_again",
    which lives in the first part of the aforementioned "if".
    
    The problem is that, in that part of the code, we expect the semaphore
    file to exist, and as such O_CREAT (this time the flag we pass to
    open(2)) needs to be cleaned from open_flags, otherwise we'll see
    another failure (this time unexpected) when trying to open the file,
    which will lead the call to sem_open to fail as well.
    
    This can cause very strange bugs, especially with OpenMPI, which makes
    extensive use of semaphores.
    
    Fix the bug by simplifying the logic when choosing open(2) flags and
    making sure O_CREAT is not set when the semaphore file is expected to
    exist.
    
    A regression test for this issue would require a complex and cpu time
    consuming logic, since to trigger the wrong code path is not
    straightforward due the racy condition.  There is a somewhat reliable
    reproducer in the bug, but it requires using OpenMPI.
    
    This resolves BZ #30789.
    
    See also: https://bugs.launchpad.net/ubuntu/+source/h5py/+bug/2031912
    
    Signed-off-by: Sergio Durigan Junior <sergiodj@sergiodj.net>
    Co-Authored-By: Simon Chopin <simon.chopin@canonical.com>
    Co-Authored-By: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
    Fixes: 533deafbdf189f5fbb280c28562dd43ace2f4b0f ("Use O_CLOEXEC in more places (BZ #15722)")
    (cherry picked from commit f957f47df75b9fab995754011491edebc6feb147)
    (cherry picked from commit 63dbbc5c52f9823f86270f32fce20d1e91cdf484)

 NEWS                       |  2 ++
 sysdeps/pthread/sem_open.c | 10 ++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

commit b83465a8ca0c6705e7a48e3286261d989bb9c3ea (tag: gentoo/glibc-2.38-7)
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Oct 19 09:17:38 2023 +0200

    Revert "elf: Move l_init_called_next to old place of l_text_end in link map"
    
    This reverts commit d3ba6c1333b10680ce5900a628108507d9d4b844.
    
    Reason: Preserve internal ABI.
    (cherry picked from commit 1e04dcec491bd8f48b5b74ce3e8414132578a645)

 include/link.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

commit 0071d694f2cf3f1e79a1364b081d204ef7bebcb8 (tag: gentoo/glibc-2.38-6)
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Oct 18 14:25:46 2023 +0200

    Revert "elf: Always call destructors in reverse constructor order (bug 30785)"
    
    This reverts commit a3189f66a5f2fe86568286fa025fa153be04c6c0.
    
    Reason for revert: Incompatibility with existing applications.
    
    (cherry picked from commit 719866ab2ff0e6d514a04fb47e507d92e70ef7ee)

 NEWS                       |   1 -
 elf/dl-close.c             | 113 ++++++++++++---------------------
 elf/dl-fini.c              | 152 +++++++++++++++++++++++++++++----------------
 elf/dl-init.c              |  16 -----
 elf/dso-sort-tests-1.def   |  19 ++++--
 elf/tst-audit23.c          |  44 ++++++-------
 sysdeps/generic/ldsodefs.h |   4 --
 7 files changed, 173 insertions(+), 176 deletions(-)

commit f23d121596d5c48b5acc80a07988c64b0214d43b
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Oct 18 14:22:59 2023 +0200

    Revert "elf: Remove unused l_text_end field from struct link_map"
    
    This reverts commit 750f19526ae71aac801c77a3f7ef5374890c09b7.
    
    Reason for revert: Restore ABI after revert of commit a3189f66a5f.
    
    (cherry picked from commit e0b6c9706c91a642c781918eea52588ee8dc9f09)

 elf/dl-load.c    | 2 +-
 elf/dl-load.h    | 7 +++++--
 elf/rtld.c       | 6 ++++++
 elf/setup-vdso.h | 4 ++++
 include/link.h   | 2 ++
 5 files changed, 18 insertions(+), 3 deletions(-)

commit 01242dfdcaa473f865d6826b7d731755be518928
Author: Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>
Date:   Wed Sep 20 05:00:00 2023 +0000

    elf/dl-tunables.c: avoid processing of tunables in AT_SECURE executables
    
    Complements: owl-alt-sanitize-env

 elf/dl-tunables.c | 3 +++
 1 file changed, 3 insertions(+)

commit 63348f40c0e27de7898b8c19a4730c90e6139311 (tag: gentoo/glibc-2.38-5)
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Sep 19 18:39:32 2023 -0400

    tunables: Terminate if end of input is reached (CVE-2023-4911)
    
    The string parsing routine may end up writing beyond bounds of tunestr
    if the input tunable string is malformed, of the form name=name=val.
    This gets processed twice, first as name=name=val and next as name=val,
    resulting in tunestr being name=name=val:name=val, thus overflowing
    tunestr.
    
    Terminate the parsing loop at the first instance itself so that tunestr
    does not overflow.
    
    This also fixes up tst-env-setuid-tunables to actually handle failures
    correct and add new tests to validate the fix for this CVE.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa)
    (cherry picked from commit 750a45a783906a19591fb8ff6b7841470f1f5701)

 NEWS                          |  5 +++++
 elf/dl-tunables.c             | 17 ++++++++++-------
 elf/tst-env-setuid-tunables.c | 37 +++++++++++++++++++++++++++++--------
 3 files changed, 44 insertions(+), 15 deletions(-)

commit f239c2e9664d4693d62ac081cdbfa7fa65b44f4a
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Sep 19 13:25:40 2023 -0400

    Propagate GLIBC_TUNABLES in setxid binaries
    
    GLIBC_TUNABLES scrubbing happens earlier than envvar scrubbing and some
    tunables are required to propagate past setxid boundary, like their
    env_alias.  Rely on tunable scrubbing to clean out GLIBC_TUNABLES like
    before, restoring behaviour in glibc 2.37 and earlier.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 0d5f9ea97f1b39f2a855756078771673a68497e1)
    (cherry picked from commit 73e3fcd1a552783e66ff1f65c5f322e2f17a81d1)

 sysdeps/generic/unsecvars.h | 1 -
 1 file changed, 1 deletion(-)

commit 5687086280183623d143816a27e640b6675b89d9 (tag: gentoo/glibc-2.38-4)
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Sep 26 07:38:07 2023 -0400

    Document CVE-2023-4806 and CVE-2023-5156 in NEWS
    
    These are tracked in BZ #30884 and BZ #30843.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit fd134feba35fa839018965733b34d28a09a075dd)
    (cherry picked from commit f6445dc94da185b3d1ee283f0ca0a34c4e1986cc)

 NEWS | 9 +++++++++
 1 file changed, 9 insertions(+)

commit 4239cf689516ca2bab013994feed150cffc9e4fa
Author: Romain Geissler <romain.geissler@amadeus.com>
Date:   Mon Sep 25 01:21:51 2023 +0100

    Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
    
    This patch fixes a very recently added leak in getaddrinfo.
    
    This was assigned CVE-2023-5156.
    
    Resolves: BZ #30884
    Related: BZ #30842
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit ec6b95c3303c700eb89eebeda2d7264cc184a796)
    (cherry picked from commit 5ee59ca371b99984232d7584fe2b1a758b4421d3)

 nss/Makefile                    | 20 ++++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.c |  3 +++
 sysdeps/posix/getaddrinfo.c     |  4 +---
 3 files changed, 24 insertions(+), 3 deletions(-)

commit f307c5e962056bdfed8db4d160e2413b76a03c55 (tag: gentoo/glibc-2.38-3)
Author: Mark Wielaard <mark@klomp.org>
Date:   Thu Aug 24 21:36:34 2023 +0200

    manual/jobs.texi: Add missing @item EPERM for getpgid
    
    The missing @item makes it look like errno will be set to ESRCH
    if a cross-session getpgid is not permitted.
    
    Found by ulfvonbelow on irc.
    
    (cherry picked from commit 5a21cefd5abab1b99eda1fbf84204a9bf41662ab)
    (cherry picked from commit 0e1ef6779a90bc0f8a05bc367796df2793deecaa)

 manual/job.texi | 1 +
 1 file changed, 1 insertion(+)

commit 0a06af9fee4c56fe06bb475caf6bfbf9fb2895ce
Author: Mahesh Bodapati <bmahi496@linux.ibm.com>
Date:   Fri Aug 11 10:38:25 2023 -0500

    string: Fix tester build with fortify enable with gcc < 12
    
    When building with fortify enabled, GCC < 12 issues a warning on the
    fortify strncat wrapper might overflow the destination buffer (the
    failure is tied to -Werror).
    
    Checked on ppc64 and x86_64.
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    
    (cherry picked from commit f1c7ed0859a45929136836341741c7cd70f428cb)
    (cherry picked from commit d94461bb86ba176b9390c0015bb612a528e22d95)

 string/tester.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

commit 73be767721621ee49cce82948f2433f74e2c04bb
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Aug 1 17:01:37 2023 +0200

    iconv: restore verbosity with unrecognized encoding names (bug 30694)
    
    Commit 91927b7c76 ("Rewrite iconv option parsing [BZ #19519]") changed the
    iconv program to call __gconv_open directly instead of the iconv_open
    wrapper, but the former does not set errno.  Update the caller to
    interpret the return codes like iconv_open does.
    
    (cherry picked from commit fc72b6d7d818ab2868920af956d1542d03342a4d)
    (cherry picked from commit 63250e9c571314b6daa2c949ea0af335ee766751)

 iconv/iconv_prog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 3cba58595df08e263b43b4a2cc19f660133d891e
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Fri Sep 15 13:51:12 2023 -0400

    getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
    
    When an NSS plugin only implements the _gethostbyname2_r and
    _getcanonname_r callbacks, getaddrinfo could use memory that was freed
    during tmpbuf resizing, through h_name in a previous query response.
    
    The backing store for res->at->name when doing a query with
    gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
    gethosts during the query.  For AF_INET6 lookup with AI_ALL |
    AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
    for a v4 lookup.  In this case, if the first call reallocates tmpbuf
    enough number of times, resulting in a malloc, th->h_name (that
    res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
    Now if the second call to gethosts also causes the plugin callback to
    return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
    reference in res->at->name.  This then gets dereferenced in the
    getcanonname_r plugin call, resulting in the use after free.
    
    Fix this by copying h_name over and freeing it at the end.  This
    resolves BZ #30843, which is assigned CVE-2023-4806.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 973fe93a5675c42798b2161c6f29c01b0e243994)
    (cherry picked from commit 00ae4f10b504bc4564e9f22f00907093f1ab9338)

 nss/Makefile                                       | 15 +++++-
 nss/nss_test_gai_hv2_canonname.c                   | 56 +++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.c                    | 63 ++++++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.h                    |  1 +
 nss/tst-nss-gai-hv2-canonname.root/postclean.req   |  0
 .../tst-nss-gai-hv2-canonname.script               |  2 +
 sysdeps/posix/getaddrinfo.c                        | 25 ++++++---
 7 files changed, 152 insertions(+), 10 deletions(-)

commit 30e278f7b43f07b7b5fabf8232cb0482c79399b6
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Sep 13 14:10:56 2023 +0200

    CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
    
    Without passing alt_dns_packet_buffer, __res_context_search can only
    store 2048 bytes (what fits into dns_packet_buffer).  However,
    the function returns the total packet size, and the subsequent
    DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
    of the stack-allocated buffer.
    
    Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
    stub resolver option") and bug 30842.
    
    (cherry picked from commit bd77dd7e73e3530203be1c52c8a29d08270cb25d)
    (cherry picked from commit b25508dd774b617f99419bdc3cf2ace4560cd2d6)

 NEWS                          |   9 +++
 resolv/Makefile               |   2 +
 resolv/nss_dns/dns-host.c     |   2 +-
 resolv/tst-resolv-noaaaa-vc.c | 129 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 141 insertions(+), 1 deletion(-)

commit d749eb775ce31675788d5ac1f86fe023a2109ac2
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Sep 11 10:06:15 2023 +0200

    NEWS: Add the 2.38.1 bug list
    
    (cherry picked from commit 89da8bc588c2296252543b049bf6d9272321f90d)

 NEWS | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

commit d8c325e099b98b1c46f62527c0bd9d262b5d1fd3
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Sep 11 09:17:52 2023 +0200

    elf: Move l_init_called_next to old place of l_text_end in link map
    
    This preserves all member offsets and the GLIBC_PRIVATE ABI
    for backporting.
    
    (cherry picked from commit d3ba6c1333b10680ce5900a628108507d9d4b844)

 include/link.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

commit 7c2515e5a156c7015bbdd710ab9939eb8db9ab60
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Sep 8 13:02:06 2023 +0200

    elf: Remove unused l_text_end field from struct link_map
    
    It is a left-over from commit 52a01100ad011293197637e42b5be1a479a2
    ("elf: Remove ad-hoc restrictions on dlopen callers [BZ #22787]").
    
    When backporting commmit 6985865bc3ad5b23147ee73466583dd7fdf65892
    ("elf: Always call destructors in reverse constructor order
    (bug 30785)"), we can move the l_init_called_next field to this
    place, so that the internal GLIBC_PRIVATE ABI does not change.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 53df2ce6885da3d0e89e87dca7b095622296014f)
    (cherry picked from commit 750f19526ae71aac801c77a3f7ef5374890c09b7)

 elf/dl-load.c    | 2 +-
 elf/dl-load.h    | 7 ++-----
 elf/rtld.c       | 6 ------
 elf/setup-vdso.h | 4 ----
 include/link.h   | 2 --
 5 files changed, 3 insertions(+), 18 deletions(-)

commit 9ae52eecb570ad74764137a56aacd647b09fdea5
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Sep 8 12:32:14 2023 +0200

    elf: Always call destructors in reverse constructor order (bug 30785)
    
    The current implementation of dlclose (and process exit) re-sorts the
    link maps before calling ELF destructors.  Destructor order is not the
    reverse of the constructor order as a result: The second sort takes
    relocation dependencies into account, and other differences can result
    from ambiguous inputs, such as cycles.  (The force_first handling in
    _dl_sort_maps is not effective for dlclose.)  After the changes in
    this commit, there is still a required difference due to
    dlopen/dlclose ordering by the application, but the previous
    discrepancies went beyond that.
    
    A new global (namespace-spanning) list of link maps,
    _dl_init_called_list, is updated right before ELF constructors are
    called from _dl_init.
    
    In dl_close_worker, the maps variable, an on-stack variable length
    array, is eliminated.  (VLAs are problematic, and dlclose should not
    call malloc because it cannot readily deal with malloc failure.)
    Marking still-used objects uses the namespace list directly, with
    next and next_idx replacing the done_index variable.
    
    After marking, _dl_init_called_list is used to call the destructors
    of now-unused maps in reverse destructor order.  These destructors
    can call dlopen.  Previously, new objects do not have l_map_used set.
    This had to change: There is no copy of the link map list anymore,
    so processing would cover newly opened (and unmarked) mappings,
    unloading them.  Now, _dl_init (indirectly) sets l_map_used, too.
    (dlclose is handled by the existing reentrancy guard.)
    
    After _dl_init_called_list traversal, two more loops follow.  The
    processing order changes to the original link map order in the
    namespace.  Previously, dependency order was used.  The difference
    should not matter because relocation dependencies could already
    reorder link maps in the old code.
    
    The changes to _dl_fini remove the sorting step and replace it with
    a traversal of _dl_init_called_list.  The l_direct_opencount
    decrement outside the loader lock is removed because it appears
    incorrect: the counter manipulation could race with other dynamic
    loader operations.
    
    tst-audit23 needs adjustments to the changes in LA_ACT_DELETE
    notifications.  The new approach for checking la_activity should
    make it clearer that la_activty calls come in pairs around namespace
    updates.
    
    The dependency sorting test cases need updates because the destructor
    order is always the opposite order of constructor order, even with
    relocation dependencies or cycles present.
    
    There is a future cleanup opportunity to remove the now-constant
    force_first and for_fini arguments from the _dl_sort_maps function.
    
    Fixes commit 1df71d32fe5f5905ffd5d100e5e9ca8ad62 ("elf: Implement
    force_first handling in _dl_sort_maps_dfs (bug 28937)").
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 6985865bc3ad5b23147ee73466583dd7fdf65892)
    (cherry picked from commit a3189f66a5f2fe86568286fa025fa153be04c6c0)

 NEWS                       |   7 +++
 elf/dl-close.c             | 113 +++++++++++++++++++++------------
 elf/dl-fini.c              | 152 ++++++++++++++++-----------------------------
 elf/dl-init.c              |  16 +++++
 elf/dso-sort-tests-1.def   |  19 ++----
 elf/tst-audit23.c          |  44 +++++++------
 include/link.h             |   4 ++
 sysdeps/generic/ldsodefs.h |   4 ++
 8 files changed, 186 insertions(+), 173 deletions(-)

commit 7382f3eb9890cb286e6876056bef88fcc7f4061e
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 22 13:56:25 2023 +0200

    elf: Do not run constructors for proxy objects
    
    Otherwise, the ld.so constructor runs for each audit namespace
    and each dlmopen namespace.
    
    (cherry picked from commit f6c8204fd7fabf0cf4162eaf10ccf23258e4d10e)
    (cherry picked from commit 7ae211a01b085d0bde54bd13b887ce8f9d57c2b4)

 elf/dl-init.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

commit bcfb847830eab94be532014b8ee1d2cf6fa0b610
Author: Adam Jackson <ajax@redhat.com>
Date:   Fri Sep 8 15:55:19 2023 -0400

    libio: Fix oversized __io_vtables
    
    IO_VTABLES_LEN is the size of the struct array in bytes, not the number
    of __IO_jump_t's in the array. Drops just under 384kb from .rodata on
    LP64 machines.
    
    Fixes: 3020f72618e ("libio: Remove the usage of __libc_IO_vtables")
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Reviewed-by: Florian Weimer <fweimer@redhat.com>
    Tested-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 8cb69e054386f980f9ff4d93b157861d72b2019e)
    (cherry picked from commit 92201f16cbcfd9eafe314ef6654be2ea7ba25675)

 libio/vtables.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

commit 3c8fe579dc0feead147a1d67ab2c3bd2aff27ac1
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Mon Aug 28 23:30:37 2023 +0200

    io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64
    
    Commit 5f828ff824e3b7cd1 ("io: Fix F_GETLK, F_SETLK, and F_SETLKW for
    powerpc64") fixed an issue with the value of the lock constants on
    powerpc64 when not using __USE_FILE_OFFSET64, but it ended-up also
    changing the value when using __USE_FILE_OFFSET64 causing an API change.
    
    Fix that by also checking that define, restoring the pre
    4d0fe291aed3a476a commit values:
    
    Default values:
    - F_GETLK: 5
    - F_SETLK: 6
    - F_SETLKW: 7
    
    With -D_FILE_OFFSET_BITS=64:
    - F_GETLK: 12
    - F_SETLK: 13
    - F_SETLKW: 14
    
    At the same time, it has been noticed that there was no test for io lock
    with __USE_FILE_OFFSET64, so just add one.
    
    Tested on x86_64-linux-gnu, i686-linux-gnu and
    powerpc64le-unknown-linux-gnu.
    
    Resolves: BZ #30804.
    Co-authored-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
    (cherry picked from commit 434bf72a94de68f0cc7fbf3c44bf38c1911b70cb)
    (cherry picked from commit 5bdef6f27c91f45505ed5444147be4ed0e9bc3c7)

 NEWS                                         | 2 ++
 io/Makefile                                  | 1 +
 io/tst-fcntl-lock-lfs.c                      | 2 ++
 sysdeps/unix/sysv/linux/powerpc/bits/fcntl.h | 2 +-
 4 files changed, 6 insertions(+), 1 deletion(-)

commit 3655fa1d10a0c23e146da47bf6c6e6b7087b99fe
Author: Sam James <sam@gentoo.org>
Date:   Thu Aug 17 09:30:29 2023 +0100

    sysdeps: tst-bz21269: fix -Wreturn-type
    
    Thanks to Andreas Schwab for reporting.
    
    Fixes: 652b9fdb77d9fd056d4dd26dad2c14142768ab49
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 369f373057073c307938da91af16922bda3dff6a)
    (cherry picked from commit 1aed90c9c8f8be9f68b58e96b6e4cd0fc08eb2b1)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 2 --
 1 file changed, 2 deletions(-)

commit ed51a5a6ce550304cccbd654db6f6f225d17ae2a
Author: Sam James <sam@gentoo.org>
Date:   Sat Aug 5 00:04:33 2023 +0100

    sysdeps: tst-bz21269: handle ENOSYS & skip appropriately
    
    SYS_modify_ldt requires CONFIG_MODIFY_LDT_SYSCALL to be set in the kernel, which
    some distributions may disable for hardening. Check if that's the case (unset)
    and mark the test as UNSUPPORTED if so.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 652b9fdb77d9fd056d4dd26dad2c14142768ab49)
    (cherry picked from commit ad9b8399537670a990572c4b0c4da5411e3b68cf)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

commit 6a637a4fff958997b4c01b549589fc96055f07b9
Author: Sam James <sam@gentoo.org>
Date:   Fri Aug 4 23:58:27 2023 +0100

    sysdeps: tst-bz21269: fix test parameter
    
    All callers pass 1 or 0x11 anyway (same meaning according to man page),
    but still.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit e0b712dd9183d527aae4506cd39564c14af3bb28)
    (cherry picked from commit c8ecda6251dd4a0dfe074e0a6011211cadeef742)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 69ee5dc11a56c29c240161ec4dae6abd3c952776 (tag: gentoo/glibc-2.38-2)
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Aug 10 19:36:56 2023 +0200

    malloc: Remove bin scanning from memalign (bug 30723)
    
    On the test workload (mpv --cache=yes with VP9 video decoding), the
    bin scanning has a very poor success rate (less than 2%).  The tcache
    scanning has about 50% success rate, so keep that.
    
    Update comments in malloc/tst-memalign-2 to indicate the purpose
    of the tests.  Even with the scanning removed, the additional
    merging opportunities since commit 542b1105852568c3ebc712225ae78b
    ("malloc: Enable merging of remainders in memalign (bug 30723)")
    are sufficient to pass the existing large bins test.
    
    Remove leftover variables from _int_free from refactoring in the
    same commit.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 0dc7fc1cf094406a138e4d1bcf9553e59edcf89d)
    (cherry picked from commit 2af141bda3cd407abd4bedf615f9e45fe79518e2)

 NEWS                    |   1 +
 malloc/malloc.c         | 169 ++----------------------------------------------
 malloc/tst-memalign-2.c |   7 +-
 3 files changed, 11 insertions(+), 166 deletions(-)

commit 12249ca1b007c9d86a744af9b57bcc7e31d5a7b4
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Aug 11 11:18:17 2023 +0200

    malloc: Enable merging of remainders in memalign (bug 30723)
    
    Previously, calling _int_free from _int_memalign could put remainders
    into the tcache or into fastbins, where they are invisible to the
    low-level allocator.  This results in missed merge opportunities
    because once these freed chunks become available to the low-level
    allocator, further memalign allocations (even of the same size are)
    likely obstructing merges.
    
    Furthermore, during forwards merging in _int_memalign, do not
    completely give up when the remainder is too small to serve as a
    chunk on its own.  We can still give it back if it can be merged
    with the following unused chunk.  This makes it more likely that
    memalign calls in a loop achieve a compact memory layout,
    independently of initial heap layout.
    
    Drop some useless (unsigned long) casts along the way, and tweak
    the style to more closely match GNU on changed lines.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 542b1105852568c3ebc712225ae78b8c8ba31a78)
    (cherry picked from commit 98c293c61f770b6b7a22f89a6ea81b711ecb1952)

 malloc/malloc.c | 197 ++++++++++++++++++++++++++++++++++----------------------
 1 file changed, 121 insertions(+), 76 deletions(-)

commit c8563e31fe575c503cfcaf2d1638ecf00fd587cf
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Aug 8 09:27:55 2023 -0300

    i686: Fix build with --disable-multiarch
    
    Since i686 provides the fortified wrappers for memcpy, mempcpy,
    memmove, and memset on the same string implementation, the static
    build tries to optimized it by not tying the fortified wrappers
    to string routine (to avoid pulling the fortify function if
    they are not required).
    
    Checked on i686-linux-gnu building with different option:
    default and --disable-multi-arch plus default, --disable-default-pie,
    --enable-fortify-source={2,3}, and --enable-fortify-source={2,3}
    with --disable-default-pie.
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    
    (cherry picked from commit c73c96a4a1af1326df7f96eec58209e1e04066d8)
    (cherry picked from commit 7ac405a74c6069b0627dc2d8449a82a621f8ff06)

 sysdeps/i386/i686/memcpy.S                | 2 +-
 sysdeps/i386/i686/mempcpy.S               | 2 +-
 sysdeps/i386/i686/multiarch/memcpy_chk.c  | 2 ++
 sysdeps/i386/i686/multiarch/memmove_chk.c | 2 ++
 sysdeps/i386/i686/multiarch/mempcpy_chk.c | 2 ++
 sysdeps/i386/i686/multiarch/memset_chk.c  | 2 ++
 6 files changed, 10 insertions(+), 2 deletions(-)

commit 136fefff5c5b80a85bc6fb7ae4fffd62acb217f7
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Aug 8 09:27:54 2023 -0300

    x86_64: Fix build with --disable-multiarch (BZ 30721)
    
    With multiarch disabled, the default memmove implementation provides
    the fortify routines for memcpy, mempcpy, and memmove.  However, it
    does not provide the internal hidden definitions used when building
    with fortify enabled.  The memset has a similar issue.
    
    Checked on x86_64-linux-gnu building with different options:
    default and --disable-multi-arch plus default, --disable-default-pie,
    --enable-fortify-source={2,3}, and --enable-fortify-source={2,3}
    with --disable-default-pie.
    Tested-by: Andreas K. Huettel <dilfridge@gentoo.org>
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    
    (cherry picked from commit 51cb52214fcd72849c640b12f5099ed3ac776181)
    (cherry picked from commit 6135d50e44233d8c89ca788f78c669941ad09fb9)

 sysdeps/x86_64/memcpy.S  | 2 +-
 sysdeps/x86_64/memmove.S | 3 +++
 sysdeps/x86_64/memset.S  | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

commit df043ed8177611029e49be4e73a16c3923cdc2da
Author: Noah Goldstein <goldstein.w.n@gmail.com>
Date:   Thu Aug 10 19:28:24 2023 -0500

    x86: Fix incorrect scope of setting `shared_per_thread` [BZ# 30745]
    
    The:
    
    ```
        if (shared_per_thread > 0 && threads > 0)
          shared_per_thread /= threads;
    ```
    
    Code was accidentally moved to inside the else scope.  This doesn't
    match how it was previously (before af992e7abd).
    
    This patch fixes that by putting the division after the `else` block.
    
    (cherry picked from commit 084fb31bc2c5f95ae0b9e6df4d3cf0ff43471ede)
    (cherry picked from commit 5ea70cc02626d9b85f1570153873d8648a47bf95)

 sysdeps/x86/dl-cacheinfo.h | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

commit 737904507691fce7dbc9a59dfbbcba1c14580367
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Aug 11 10:10:16 2023 +0200

    nscd: Do not rebuild getaddrinfo (bug 30709)
    
    The nscd daemon caches hosts data from NSS modules verbatim, without
    filtering protocol families or sorting them (otherwise separate caches
    would be needed for certain ai_flags combinations).  The cache
    implementation is complete separate from the getaddrinfo code.  This
    means that rebuilding getaddrinfo is not needed.  The only function
    actually used is __bump_nl_timestamp from check_pf.c, and this change
    moves it into nscd/connections.c.
    
    Tested on x86_64-linux-gnu with -fexceptions, built with
    build-many-glibcs.py.  I also backported this patch into a distribution
    that still supports nscd and verified manually that caching still works.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 039ff51ac7e02db1cfc0c23e38ac7bfbb00221d1)
    (cherry picked from commit 6b99458d197ab779ebb6ff632c168e2cbfa4f543)

 include/ifaddrs.h                  |  4 ---
 inet/check_pf.c                    |  9 -------
 nscd/Makefile                      |  2 +-
 nscd/connections.c                 | 11 +++++++++
 nscd/gai.c                         | 50 --------------------------------------
 sysdeps/unix/sysv/linux/check_pf.c | 17 +------------
 6 files changed, 13 insertions(+), 80 deletions(-)

commit 9a74d9a7e1ccb876b1a3e4b8f54b82b06c796016
Author: Sajan Karumanchi <sajan.karumanchi@amd.com>
Date:   Tue Aug 1 15:20:55 2023 +0000

    x86: Fix for cache computation on AMD legacy cpus.
    
    Some legacy AMD CPUs and hypervisors have the _cpuid_ '0x8000_001D'
    set to Zero, thus resulting in zeroed-out computed cache values.
    This patch reintroduces the old way of cache computation as a
    fail-safe option to handle these exceptions.
    Fixed 'level4_cache_size' value through handle_amd().
    
    Reviewed-by: Premachandra Mallappa <premachandra.mallappa@amd.com>
    Tested-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit ced101ed9d3b7cfd12d97ef24940cb00b8658c81)

 sysdeps/x86/dl-cacheinfo.h | 226 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 199 insertions(+), 27 deletions(-)

commit ca9228846b6d7cca04fa29cd91f27d956146e3ff
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 1 10:27:15 2023 +0200

    stdlib: Improve tst-realpath compatibility with source fortification
    
    On GCC before 11, IPA can make the fortified realpath aware that the
    buffer size is not large enough (8 bytes instead of PATH_MAX bytes).
    Fix this by using a buffer that is large enough.
    
    (cherry picked from commit 510fc20d73de12c85823d9996faac74666e9c2e7)
    (cherry picked from commit d97cca1e5df812be0e4de1e38091f02bb1e7ec4e)

 stdlib/tst-realpath.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

commit fa7f864c669e484728fa6812b71466ee0efda875 (tag: gentoo/glibc-2.38-1)
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Jan 27 14:28:34 2023 -0300

    linux: Use getdents64 on readdir64 compat implementation
    
    It uses a similar strategy from the non-LFS readdir that also
    uses getdents64 internally and uses a translation buffer to return
    the compat readdir64 entry.
    
    It allows to remove __old_getdents64.
    
    Checked on i686-linux-gnu.

 sysdeps/unix/sysv/linux/dirstream.h  | 13 ++++-
 sysdeps/unix/sysv/linux/getdents64.c | 93 ------------------------------------
 sysdeps/unix/sysv/linux/olddirent.h  |  2 -
 sysdeps/unix/sysv/linux/readdir64.c  | 50 ++++++++++++++-----
 4 files changed, 50 insertions(+), 108 deletions(-)

commit b7328979355208b2fff3440aa31a61cd555eda42
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Jan 27 14:28:33 2023 -0300

    linux: Add __old_readdir64_unlocked
    
    And use it __old_readdir64_r.
    
    Checked on i686-linux-gnu.

 sysdeps/unix/sysv/linux/olddirent.h   |  2 +
 sysdeps/unix/sysv/linux/readdir64.c   | 24 +++++++----
 sysdeps/unix/sysv/linux/readdir64_r.c | 79 ++++++++---------------------------
 3 files changed, 35 insertions(+), 70 deletions(-)

commit be0329ac6b93d5421cf3cfa1ff55f25b9a163028
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Jan 27 14:28:32 2023 -0300

    linux: Add __readdir64_unlocked
    
    And use it on readdir_r implementation.
    
    Checked on i686-linux-gnu.

 include/dirent.h                      |  1 +
 sysdeps/unix/sysv/linux/readdir64.c   | 20 ++++++---
 sysdeps/unix/sysv/linux/readdir64_r.c | 80 ++++++++---------------------------
 3 files changed, 33 insertions(+), 68 deletions(-)

commit 78ff7263cf6825c7a4b8523b03f9d8ee3b1e7915
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Jan 27 14:28:31 2023 -0300

    linux: Set internal DIR filepos as off64_t (BZ #23960, BZ #24050)
    
    It allows to obtain the expected entry offset on telldir and set
    it correctly on seekdir on platforms where long int is smaller
    than off64_t.
    
    On such cases opendir creates a map entry between the DIR d_off
    offset and the returned long int (the telldir return value).
    seekdir will then set the correct offset from the internal list
    using the telldir as the list key.
    
    It also removes the overflow check on readdir and the returned value
    will be truncated by the non-LFS off_t size.  As Joseph has noted
    in BZ #23960 comment #22, d_off is an opaque value and since
    telldir/seekdir works regardless of the returned dirent d_off value.
    
    Finally it removes the requirement to check for overflow values on
    telldir (BZ #24050).
    
    Checked on x86_64-linux-gnu, i686-linux-gnu, powerpc-linux-gnu,
    and arm-linux-gnueabihf.

 dirent/tst-seekdir.c                        |   8 ++
 sysdeps/unix/sysv/linux/Makefile            |   1 +
 sysdeps/unix/sysv/linux/alpha/bits/dirent.h |   3 +
 sysdeps/unix/sysv/linux/bits/dirent.h       |   4 +
 sysdeps/unix/sysv/linux/closedir.c          |   4 +
 sysdeps/unix/sysv/linux/dirstream.h         |   6 +-
 sysdeps/unix/sysv/linux/opendir.c           |   3 +
 sysdeps/unix/sysv/linux/readdir.c           |  11 ++-
 sysdeps/unix/sysv/linux/rewinddir.c         |   5 +
 sysdeps/unix/sysv/linux/seekdir.c           |  35 ++++++-
 sysdeps/unix/sysv/linux/telldir.c           |  35 +++++++
 sysdeps/unix/sysv/linux/telldir.h           |  65 +++++++++++++
 sysdeps/unix/sysv/linux/tst-opendir-nolfs.c | 146 ++++++++++++++++++++++++++++
 13 files changed, 319 insertions(+), 7 deletions(-)

commit 7165ae0d0f3e181b18cb79e139821b1f00ded059
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Jan 27 14:28:30 2023 -0300

    linux: Use getdents64 on non-LFS readdir
    
    The non-LFS opendir reserves a translation entry to be used to return
    the entry and the dirent64 struct is translated to the temporary buffer
    on each readdir call.
    
    Entries that overflow d_off/d_ino and the buffer reallocation failure
    (in case of large d_name) are ignored.
    
    Checked on x86_64-linux-gnu and i686-linux-gnu.

 dirent/tst-scandir.c                |  6 ++-
 include/dirent.h                    |  2 +-
 sysdeps/unix/sysv/linux/dirstream.h |  5 +++
 sysdeps/unix/sysv/linux/readdir.c   | 83 +++++++++++++++++++++++++------------
 4 files changed, 67 insertions(+), 29 deletions(-)

commit 68f5f814329f282a8c5fb71cce36b2b3e5d4b925
Author: Sergei Trofimovich <slyfox@gentoo.org>
Date:   Sat Jul 11 20:06:51 2020 +0300

    Fix miscompilation on ia64's gcc-10
    
    Bug: https://bugs.gentoo.org/723268
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 sysdeps/unix/sysv/linux/ia64/dl-sysdep.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

commit a00120d733fa937b69adaa68d09af43d9c845824
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Fri Dec 14 20:43:04 2018 +0100

    Force -O0 in conform tests to survive $CC changes
    
    In bug #659030 Gentoo started passing user's CFLAGS via $CC variable.
    conform tests should but are not ready to handle -O1/-O2 yet.
    Tests fail to validate headers due to inlining of weak symbol aliases
    and other problems. Let's force it back to -O0 until it's fixed upstream.
    
    Original patch by Sergei, ported to the new python test framework by Andreas
    
    Bug: https://bugs.gentoo.org/659030
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 conform/conformtest.py   | 6 ++++--
 conform/linknamespace.py | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

commit af7770c80f9f361d661d8392670386b07dd987ab
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Mon Oct 22 22:34:13 2018 +0200

    Adapt to Gentoo-specific /etc/mail/aliases
    
    Patch by pacho2
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
    (cherry picked from commit 4e616cda056f471b799beba2b1cedc787ad4ecc0)
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 nss/nss_files/files-alias.c    |  2 +-
 nss/tst-nss-files-alias-leak.c | 18 +++++++++---------
 support/support_chroot.c       |  8 +++++++-
 3 files changed, 17 insertions(+), 11 deletions(-)

commit e6c168146be4790fcf80dda1076b38fe7fdfe45d
Author: Mike Frysinger <vapier@gentoo.org>
Date:   Tue Aug 3 00:34:59 2021 +0200

    Disable ldconfig during install
    
    Do not bother running ldconfig on DESTDIR.  It's a waste of time as we
    won't use the result (portage will rebuild the cache after install).
    Also, the Gentoo sandbox does not currently catch chroot() behavior so
    we end up (incorrectly) flagging it as a violation as a write to /etc.
    
    http://sourceware.org/ml/libc-alpha/2012-08/msg00118.html
    https://bugs.gentoo.org/431038
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 Makefile | 1 +
 1 file changed, 1 insertion(+)
