commit bdac1623cca4c3d1683e24cc7d093201c5d9fa26
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Feb 6 09:19:03 2018 +0100

    Record CVE-2018-6551 in NEWS and ChangeLog [BZ #22774]
    
    (cherry picked from commit 71aa429b029fdb6f9e65d44050388b51eca460d6)

diff --git a/ChangeLog b/ChangeLog
index f3fe2716b2..76e2767086 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -710,7 +710,9 @@
 2018-01-18  Arjun Shankar  <arjun@redhat.com>
 
 	[BZ #22343]
+	[BZ #22774]
 	CVE-2018-6485
+	CVE-2018-6551
 	* malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE
 	after padding.
 	(_int_memalign): check for integer overflow before calling
diff --git a/NEWS b/NEWS
index a71c1038a8..0f7b0d5a9a 100644
--- a/NEWS
+++ b/NEWS
@@ -262,6 +262,10 @@ Security related changes:
   an object size near the value of SIZE_MAX, would return a pointer to a
   buffer which is too small, instead of NULL.  Reported by Jakub Wilk.
 
+  CVE-2018-6551: The malloc function, when called with an object size near
+  the value of SIZE_MAX, would return a pointer to a buffer which is too
+  small, instead of NULL.
+
 The following bugs are resolved with this release:
 
   [866] glob: glob should match dangling symlinks

commit ce8a6550fa33363f9c5043fe1b3e9900c1145888
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Mon Feb 5 05:46:38 2018 -0800

    sparc: Check PIC instead of SHARED in start.S [BZ #22638]
    
    Since start.o may be compiled as PIC, we should check PIC instead of
    SHARED.
    
            [BZ #22638]
            * sysdeps/sparc/sparc32/start.S (_start): Check PIC instead of
            SHARED.
            * sysdeps/sparc/sparc64/start.S (_start): Likewise.
    
    (cherry picked from commit 371b220f6208968d5f4bffc9f66bf885930a42a5)

diff --git a/ChangeLog b/ChangeLog
index 76e2767086..6b1369a357 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-02-05  H.J. Lu  <hongjiu.lu@intel.com>
+
+	[BZ #22638]
+	* sysdeps/sparc/sparc32/start.S (_start): Check PIC instead of
+	SHARED.
+
 2018-02-01  Dmitry V. Levin  <ldv@altlinux.org>
 
 	* version.h (RELEASE): Set to "stable".
diff --git a/sysdeps/sparc/sparc32/start.S b/sysdeps/sparc/sparc32/start.S
index 1db7327fc6..46ba8b6afa 100644
--- a/sysdeps/sparc/sparc32/start.S
+++ b/sysdeps/sparc/sparc32/start.S
@@ -42,7 +42,7 @@
 	.global _start
 	.type _start,#function
 _start:
-#ifdef SHARED
+#ifdef PIC
 	SETUP_PIC_REG(l7)
 #endif
 
@@ -57,7 +57,7 @@ _start:
 	add	%sp, 23*4, %o2
 
   /* Load the addresses of the user entry points.  */
-#ifndef SHARED
+#ifndef PIC
 	sethi	%hi(main), %o0
 	sethi	%hi(__libc_csu_init), %o3
 	sethi	%hi(__libc_csu_fini), %o4
diff --git a/sysdeps/sparc/sparc64/start.S b/sysdeps/sparc/sparc64/start.S
index e1865f10cb..75ff5093dc 100644
--- a/sysdeps/sparc/sparc64/start.S
+++ b/sysdeps/sparc/sparc64/start.S
@@ -42,7 +42,7 @@
 	.global _start
 	.type _start,#function
 _start:
-#ifdef SHARED
+#ifdef PIC
 	SETUP_PIC_REG(l7)
 #endif
 
@@ -58,7 +58,7 @@ _start:
 	add	%sp, STACK_BIAS+23*8, %o2
 
   /* Load the addresses of the user entry points.  */
-#ifndef SHARED
+#ifndef PIC
 	sethi	%hi(main), %o0
 	sethi	%hi(__libc_csu_init), %o3
 	sethi	%hi(__libc_csu_fini), %o4

commit c8ad6ac1d1ac7600138b9dbd0b92e88c36cc999c
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Tue Feb 6 09:31:30 2018 +0000

    NEWS: add an entry for bug 22638

diff --git a/NEWS b/NEWS
index 0f7b0d5a9a..4bb08b1dbf 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,14 @@ See the end for copying conditions.
 Please send GNU C library bug reports via <https://sourceware.org/bugzilla/>
 using `glibc' in the "product" field.
 
+Version 2.27.1
+
+The following bugs are resolved with this release:
+
+  [22638] sparc: static binaries are broken if glibc is built by gcc
+    configured with --enable-default-pie
+
+
 Version 2.27
 
 Major new features:

commit 00c5a2d77a541fa005cb460bd1a45f51f1aa71ea
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Mon Feb 5 06:17:18 2018 -0800

    Add a missing ChangeLog item in commit 371b220f620
    
    (cherry picked from commit 658050164df9bce9ef8f2ccb1b74ba9ee2b2f4af)

diff --git a/ChangeLog b/ChangeLog
index 6b1369a357..65ebfbcb52 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@
 	[BZ #22638]
 	* sysdeps/sparc/sparc32/start.S (_start): Check PIC instead of
 	SHARED.
+	* sysdeps/sparc/sparc64/start.S (_start): Likewise.
 
 2018-02-01  Dmitry V. Levin  <ldv@altlinux.org>
 

commit 56170e064e2b21ce204f0817733e92f1730541ea
Author: Igor Gnatenko <ignatenko@redhat.com>
Date:   Wed Feb 7 13:53:10 2018 +0100

    Linux: use reserved name __key in pkey_get [BZ #22797]
    
    _key is not reserved name and we should avoid using that. It seems that
    it was simple typo when pkey_* was implemented.
    
    (cherry picked from commit 388ff7bd0d57d7061fdd39a2f26f65687e8058da)

diff --git a/ChangeLog b/ChangeLog
index 65ebfbcb52..cfe43e3bc0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-02-07  Igor Gnatenko  <ignatenko@redhat.com>
+
+	[BZ #22797]
+	* sysdeps/unix/sysv/linux/bits/mman-shared.h (pkey_get): Add
+	missing second underscore to parameter name.
+
 2018-02-05  H.J. Lu  <hongjiu.lu@intel.com>
 
 	[BZ #22638]
diff --git a/NEWS b/NEWS
index 4bb08b1dbf..1e4cb10612 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,7 @@ The following bugs are resolved with this release:
 
   [22638] sparc: static binaries are broken if glibc is built by gcc
     configured with --enable-default-pie
+  [22797] Linux: use reserved name __key in pkey_get
 
 
 Version 2.27
diff --git a/sysdeps/unix/sysv/linux/bits/mman-shared.h b/sysdeps/unix/sysv/linux/bits/mman-shared.h
index 7715e680ca..d15ba95c9d 100644
--- a/sysdeps/unix/sysv/linux/bits/mman-shared.h
+++ b/sysdeps/unix/sysv/linux/bits/mman-shared.h
@@ -61,7 +61,7 @@ int pkey_set (int __key, unsigned int __access_rights) __THROW;
 
 /* Return the access rights for the current thread for KEY, which must
    have been allocated using pkey_alloc.  */
-int pkey_get (int _key) __THROW;
+int pkey_get (int __key) __THROW;
 
 /* Free an allocated protection key, which must have been allocated
    using pkey_alloc.  */

commit 750a1c253f81a9dfe2cef5a568c68a5838ab46b9
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Feb 9 18:37:15 2018 -0500

    [RISC-V] Fix parsing flags in ELF64 files.
    
    When ldconfig reads Elf64 files to determine the ABI, it used the
    Elf32 type, so read the wrong location, and stored the wrong ABI
    type in the cache, making the cache useless.  This patch uses
    an Elf64 type for Elf64 objects instead.
    
    Note that pre-patch caches might need to be manually removed and
    regenerated to get the correct ABIs stored.
    
            [BZ #22827]
            * sysdeps/unix/sysv/linux/riscv/readelflib.c (process_elf_file): Use
            64-bit ELF type for 64-bit ELF objects.
    
    (cherry picked from commit 6a1ff640dcec04905d8518983ad6252d38b7a733)

diff --git a/ChangeLog b/ChangeLog
index cfe43e3bc0..7be7772777 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-02-09  DJ Delorie  <dj@redhat.com>
+
+	[BZ #22827]
+	* sysdeps/unix/sysv/linux/riscv/readelflib.c (process_elf_file): Use
+	64-bit ELF type for 64-bit ELF objects.
+
 2018-02-07  Igor Gnatenko  <ignatenko@redhat.com>
 
 	[BZ #22797]
diff --git a/sysdeps/unix/sysv/linux/riscv/readelflib.c b/sysdeps/unix/sysv/linux/riscv/readelflib.c
index 6e249ff82f..7e27e0c1d6 100644
--- a/sysdeps/unix/sysv/linux/riscv/readelflib.c
+++ b/sysdeps/unix/sysv/linux/riscv/readelflib.c
@@ -43,6 +43,7 @@ process_elf_file (const char *file_name, const char *lib, int *flag,
 {
   ElfW(Ehdr) *elf_header = (ElfW(Ehdr) *) file_contents;
   Elf32_Ehdr *elf32_header = (Elf32_Ehdr *) elf_header;
+  Elf64_Ehdr *elf64_header = (Elf64_Ehdr *) elf_header;
   int ret;
   long flags;
 
@@ -59,7 +60,7 @@ process_elf_file (const char *file_name, const char *lib, int *flag,
     {
       ret = process_elf64_file (file_name, lib, flag, osversion, soname,
 				file_contents, file_length);
-      flags = elf32_header->e_flags;
+      flags = elf64_header->e_flags;
     }
 
   /* RISC-V linkers encode the floating point ABI as part of the ELF headers.  */
