commit 5e5ddf57987ae4b37da5ca2fa039c8803b0be735
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Jul 25 09:20:26 2026 +0900

    advisories: replace with ADVISORIES text file
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

diff --git a/ADVISORIES b/ADVISORIES
new file mode 100644
index 0000000000..d4e33f2df3
--- /dev/null
+++ b/ADVISORIES
@@ -0,0 +1,2 @@
+For the GNU C Library Security Advisories, see the git master branch:
+https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001
deleted file mode 100644
index 3d19c91b6a..0000000000
--- a/advisories/GLIBC-SA-2023-0001
+++ /dev/null
@@ -1,14 +0,0 @@
-printf: incorrect output for integers with thousands separator and width field
-
-When the printf family of functions is called with a format specifier
-that uses an <apostrophe> (enable grouping) and a minimum width
-specifier, the resulting output could be larger than reasonably expected
-by a caller that computed a tight bound on the buffer size.  The
-resulting larger than expected output could result in a buffer overflow
-in the printf family of functions.
-
-CVE-Id: CVE-2023-25139
-Public-Date: 2023-02-02
-Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37)
-Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38)
-Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4)
diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002
deleted file mode 100644
index 5122669a64..0000000000
--- a/advisories/GLIBC-SA-2023-0002
+++ /dev/null
@@ -1,15 +0,0 @@
-getaddrinfo: Stack read overflow in no-aaaa mode
-
-If the system is configured in no-aaaa mode via /etc/resolv.conf,
-getaddrinfo is called for the AF_UNSPEC address family, and a DNS
-response is received over TCP that is larger than 2048 bytes,
-getaddrinfo may potentially disclose stack contents via the returned
-address data, or crash.
-
-CVE-Id: CVE-2023-4527
-Public-Date: 2023-09-12
-Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36)
-Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39)
-Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113)
-Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38)
-Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19)
diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003
deleted file mode 100644
index d3aef80348..0000000000
--- a/advisories/GLIBC-SA-2023-0003
+++ /dev/null
@@ -1,15 +0,0 @@
-getaddrinfo: Potential use-after-free
-
-When an NSS plugin only implements the _gethostbyname2_r and
-_getcanonname_r callbacks, getaddrinfo could use memory that was freed
-during buffer resizing, potentially causing a crash or read or write to
-arbitrary memory.
-
-CVE-Id: CVE-2023-4806
-Public-Date: 2023-09-12
-Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39)
-Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420)
-Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270)
-Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115)
-Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39)
-Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20)
diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004
deleted file mode 100644
index 5286a7aa54..0000000000
--- a/advisories/GLIBC-SA-2023-0004
+++ /dev/null
@@ -1,16 +0,0 @@
-tunables: local privilege escalation through buffer overflow
-
-If a tunable of the form NAME=NAME=VAL is passed in the environment of a
-setuid program and NAME is valid, it may result in a buffer overflow,
-which could be exploited to achieve escalated privileges.  This flaw was
-introduced in glibc 2.34.
-
-CVE-Id: CVE-2023-4911
-Public-Date: 2023-10-03
-Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34)
-Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39)
-Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423)
-Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274)
-Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118)
-Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45)
-Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27)
diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005
deleted file mode 100644
index cc4eb90b82..0000000000
--- a/advisories/GLIBC-SA-2023-0005
+++ /dev/null
@@ -1,18 +0,0 @@
-getaddrinfo: DoS due to memory leak
-
-The fix for CVE-2023-4806 introduced a memory leak when an application
-calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED
-flags set.
-
-CVE-Id: CVE-2023-5156
-Public-Date: 2023-09-25
-Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420)
-Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270)
-Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115)
-Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39)
-Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20)
-Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421)
-Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272)
-Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116)
-Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42)
-Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24)
diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001
deleted file mode 100644
index 28931c75ae..0000000000
--- a/advisories/GLIBC-SA-2024-0001
+++ /dev/null
@@ -1,15 +0,0 @@
-syslog: Heap buffer overflow in __vsyslog_internal
-
-__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
-containing a long program name failed to update the required buffer
-size, leading to the allocation and overflow of a too-small buffer on
-the heap.
-
-CVE-Id: CVE-2023-6246
-Public-Date: 2024-01-30
-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
-Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39)
-Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42)
-Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57)
-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
-Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126)
diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002
deleted file mode 100644
index 940bfcf2fc..0000000000
--- a/advisories/GLIBC-SA-2024-0002
+++ /dev/null
@@ -1,15 +0,0 @@
-syslog: Heap buffer overflow in __vsyslog_internal
-
-__vsyslog_internal used the return value of snprintf/vsnprintf to
-calculate buffer sizes for memory allocation.  If these functions (for
-any reason) failed and returned -1, the resulting buffer would be too
-small to hold output.
-
-CVE-Id: CVE-2023-6779
-Public-Date: 2024-01-30
-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
-Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39)
-Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43)
-Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58)
-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
-Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127)
diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003
deleted file mode 100644
index b43a5150ab..0000000000
--- a/advisories/GLIBC-SA-2024-0003
+++ /dev/null
@@ -1,13 +0,0 @@
-syslog: Integer overflow in __vsyslog_internal
-
-__vsyslog_internal calculated a buffer size by adding two integers, but
-did not first check if the addition would overflow.
-
-CVE-Id: CVE-2023-6780
-Public-Date: 2024-01-30
-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
-Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39)
-Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44)
-Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59)
-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
-Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128)
diff --git a/advisories/GLIBC-SA-2024-0004 b/advisories/GLIBC-SA-2024-0004
deleted file mode 100644
index 08df2b3118..0000000000
--- a/advisories/GLIBC-SA-2024-0004
+++ /dev/null
@@ -1,28 +0,0 @@
-ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence
-
-The iconv() function in the GNU C Library versions 2.39 and older may 
-overflow the output buffer passed to it by up to 4 bytes when converting 
-strings to the ISO-2022-CN-EXT character set, which may be used to 
-crash an application or overwrite a neighbouring variable.
-
-ISO-2022-CN-EXT uses escape sequences to indicate character set changes
-(as specified by RFC 1922).  While the SOdesignation has the expected
-bounds checks, neither SS2designation nor SS3designation have its;
-allowing a write overflow of 1, 2, or 3 bytes with fixed values:
-'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.
-
-CVE-Id: CVE-2024-2961
-Public-Date: 2024-04-17
-Vulnerable-Commit: 755104edc75c53f4a0e7440334e944ad3c6b32fc (2.1.93-169)
-Fix-Commit: f9dc609e06b1136bb0408be9605ce7973a767ada (2.40)
-Fix-Commit: 31da30f23cddd36db29d5b6a1c7619361b271fb4 (2.39-31)
-Fix-Commit: e1135387deded5d73924f6ca20c72a35dc8e1bda (2.38-66)
-Fix-Commit: 89ce64b269a897a7780e4c73a7412016381c6ecf (2.37-89)
-Fix-Commit: 4ed98540a7fd19f458287e783ae59c41e64df7b5 (2.36-164)
-Fix-Commit: 36280d1ce5e245aabefb877fe4d3c6cff95dabfa (2.35-315)
-Fix-Commit: a8b0561db4b9847ebfbfec20075697d5492a363c (2.34-459)
-Fix-Commit: ed4f16ff6bed3037266f1fa682ebd32a18fce29c (2.33-263)
-Fix-Commit: 682ad4c8623e611a971839990ceef00346289cc9 (2.32-140)
-Fix-Commit: 3703c32a8d304c1ee12126134ce69be965f38000 (2.31-154)
-
-Reported-By: Charles Fol
diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005
deleted file mode 100644
index a59596610a..0000000000
--- a/advisories/GLIBC-SA-2024-0005
+++ /dev/null
@@ -1,22 +0,0 @@
-nscd: Stack-based buffer overflow in netgroup cache
-
-If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted
-by client requests then a subsequent client request for netgroup data
-may result in a stack-based buffer overflow.  This flaw was introduced
-in glibc 2.15 when the cache was added to nscd.
-
-This vulnerability is only present in the nscd binary.
-
-CVE-Id: CVE-2024-33599
-Public-Date: 2024-04-23
-Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15)
-Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155)
-Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141)
-Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264)
-Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460)
-Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316)
-Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165)
-Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91)
-Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72)
-Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35)
-Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40)
diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006
deleted file mode 100644
index d44148d3d9..0000000000
--- a/advisories/GLIBC-SA-2024-0006
+++ /dev/null
@@ -1,32 +0,0 @@
-nscd: Null pointer crash after notfound response
-
-If the Name Service Cache Daemon's (nscd) cache fails to add a not-found
-netgroup response to the cache, the client request can result in a null
-pointer dereference.  This flaw was introduced in glibc 2.15 when the
-cache was added to nscd.
-
-This vulnerability is only present in the nscd binary.
-
-CVE-Id: CVE-2024-33600
-Public-Date: 2024-04-24
-Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15)
-Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40)
-Fix-Commit: 7835b00dbce53c3c87bbbb1754a95fb5e58187aa (2.40)
-Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37)
-Fix-Commit: 5a508e0b508c8ad53bd0d2fb48fd71b242626341 (2.39-36)
-Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74)
-Fix-Commit: 541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a (2.38-73)
-Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93)
-Fix-Commit: 5eea50c4402e39588de98aa1d4469a79774703d4 (2.37-92)
-Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167)
-Fix-Commit: c34f470a615b136170abd16142da5dd0c024f7d1 (2.36-166)
-Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318)
-Fix-Commit: 4370bef52b0f3f3652c6aa13d7a9bb3ac079746d (2.35-317)
-Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462)
-Fix-Commit: 966d6ac9e40222b84bb21674cc4f83c8d72a5a26 (2.34-461)
-Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266)
-Fix-Commit: f20a8d696b13c6261b52a6434899121f8b19d5a7 (2.33-265)
-Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143)
-Fix-Commit: 394eae338199078b7961b051c191539870742d7b (2.32-142)
-Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157)
-Fix-Commit: 304ce5fe466c4762b21b36c26926a4657b59b53e (2.31-156)
diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007
deleted file mode 100644
index b6928fa27a..0000000000
--- a/advisories/GLIBC-SA-2024-0007
+++ /dev/null
@@ -1,28 +0,0 @@
-nscd: netgroup cache may terminate daemon on memory allocation failure
-
-The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or
-xrealloc and these functions may terminate the process due to a memory
-allocation failure resulting in a denial of service to the clients.  The
-flaw was introduced in glibc 2.15 when the cache was added to nscd.
-
-This vulnerability is only present in the nscd binary.
-
-Subsequent refactoring of the netgroup cache only added more uses of
-xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of
-nscd only occur during startup of the daemon and so are not affected by
-client requests that could trigger an out of memory followed by
-termination.
-
-CVE-Id: CVE-2024-33601
-Public-Date: 2024-04-24
-Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15)
-Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40)
-Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38)
-Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75)
-Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94)
-Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168)
-Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319)
-Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463)
-Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267)
-Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144)
-Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158)
diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008
deleted file mode 100644
index d93e2a6f0b..0000000000
--- a/advisories/GLIBC-SA-2024-0008
+++ /dev/null
@@ -1,26 +0,0 @@
-nscd: netgroup cache assumes NSS callback uses in-buffer strings
-
-The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory
-when the NSS callback does not store all strings in the provided buffer.
-The flaw was introduced in glibc 2.15 when the cache was added to nscd.
-
-This vulnerability is only present in the nscd binary.
-
-There is no guarantee from the NSS callback API that the returned
-strings are all within the buffer. However, the netgroup cache code
-assumes that the NSS callback uses in-buffer strings and if it doesn't
-the buffer resizing logic could lead to potential memory corruption.
-
-CVE-Id: CVE-2024-33602
-Public-Date: 2024-04-24
-Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15)
-Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40)
-Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38)
-Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75)
-Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94)
-Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168)
-Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319)
-Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463)
-Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267)
-Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144)
-Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158)
diff --git a/advisories/GLIBC-SA-2025-0001 b/advisories/GLIBC-SA-2025-0001
deleted file mode 100644
index b053d32e91..0000000000
--- a/advisories/GLIBC-SA-2025-0001
+++ /dev/null
@@ -1,40 +0,0 @@
-assert: Buffer overflow when printing assertion failure message
-
-When the assert() function fails, it does not allocate enough space for the
-assertion failure message string and size information, which may lead to a
-buffer overflow if the message string size aligns to page size.
-
-This bug can be triggered when an assertion in a program fails.  The assertion
-failure message is allocated to allow developers to see this failure in core
-dumps and it typically includes, in addition to the invariant assertion
-string and function name, the name of the program.  If the name of the failing
-program is user controlled, for example on a local system, this could allow an
-attacker to control the assertion failure to trigger this buffer overflow.
-
-The only viable vector for exploitation of this bug is local, if a setuid
-program exists that has an existing bug that results in an assertion failure.
-No such program has been discovered at the time of publishing this advisory,
-but the presence of custom setuid programs, although strongly discouraged as a
-security practice, cannot be discounted.
-
-CVE-Id: CVE-2025-0395
-Public-Date: 2025-01-22
-Vulnerable-Commit: f8a3b5bf8fa1d0c43d2458e03cc109a04fdef194 (2.13-175)
-Fix-Commit: 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578 (2.41)
-Fix-Commit: cdb9ba84191ce72e86346fb8b1d906e7cd930ea2 (2.42)
-Fix-Commit: 69fda28279b497bd405fdd442a6d8e4d3d5f681b (2.41-7)
-Fix-Commit: 7d4b6bcae91f29d7b4daf15bab06b66cf1d2217c (2.40-66)
-Fix-Commit: d6c156c326999f144cb5b73d29982108d549ad8a (2.40-71)
-Fix-Commit: 808a84a8b81468b517a4d721fdc62069cb8c211f (2.39-146)
-Fix-Commit: f6d48470aef9264d2d56f4c4533eb76db7f9c2e4 (2.39-150)
-Fix-Commit: c32fd59314c343db88c3ea4a203870481d33c3d2 (2.38-122)
-Fix-Commit: f984e2d7e8299726891a1a497a3c36cd5542a0bf (2.38-124)
-Fix-Commit: a3d7865b098a3a67c44f7812208d9ce4718873ba (2.37-143)
-Fix-Commit: b989519fe1683c204ac24ec92830e3fe3bfaccad (2.37-146)
-Fix-Commit: 7971add7ee4171fdd8dfd17e7c04c4ed77a18845 (2.36-216)
-Fix-Commit: 0487893d5c5bc6710d83d7c3152d888a0339559e (2.36-219)
-Fix-Commit: 8b5d4be762419c4f6176261c6fea40ac559b88dc (2.35-370)
-Fix-Commit: 8b3d09dc0d350191985f9d291cc30ce96f034b49 (2.35-373)
-Fix-Commit: df4e1f4a5096b385c9bcc94424cf2eaa227b3761 (2.34-500)
-Fix-Commit: 31eb872cb21449832ab47ad5db83281d240e1d03 (2.34-503)
-Reported-By: Qualys Security Advisory
diff --git a/advisories/GLIBC-SA-2025-0002 b/advisories/GLIBC-SA-2025-0002
deleted file mode 100644
index 161da13dd4..0000000000
--- a/advisories/GLIBC-SA-2025-0002
+++ /dev/null
@@ -1,23 +0,0 @@
-elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
-
-A statically linked setuid binary that calls dlopen (including internal
-dlopen calls after setlocale or calls to NSS functions such as getaddrinfo)
-may incorrectly search LD_LIBRARY_PATH to determine which library to load,
-leading to the execution of library code that is attacker controlled.
-
-The only viable vector for exploitation of this bug is local, if a static
-setuid program exists, and that program calls dlopen, then it may search
-LD_LIBRARY_PATH to locate the SONAME to load. No such program has been
-discovered at the time of publishing this advisory, but the presence of
-custom setuid programs, although strongly discouraged as a security
-practice, cannot be discounted.
-
-CVE-Id: CVE-2025-4802
-Public-Date: 2025-05-16
-Vulnerable-Commit: 10e93d968716ab82931d593bada121c17c0a4b93 (2.27)
-Fix-Commit: 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 (2.39)
-Fix-Commit: 3be3728df2f1912c80abd3288bc6e3a25ad679e4 (2.38-132)
-Fix-Commit: 7403ede2d7752e59e0c47d5d33d73c2bf850e7be (2.37-154)
-Fix-Commit: 2ef7850279b2931caf6d6d6743ebaa91839e1cf7 (2.36-227)
-Fix-Commit: 621c65ccf12ddd415ceeb2234423bd1acd0fabb3 (2.35-387)
-Fix-Commit: 35018c0fd20eac9ceaf60060fed2745b3177359d (2.34-517)
diff --git a/advisories/GLIBC-SA-2025-0003 b/advisories/GLIBC-SA-2025-0003
deleted file mode 100644
index 2adeb3ce00..0000000000
--- a/advisories/GLIBC-SA-2025-0003
+++ /dev/null
@@ -1,30 +0,0 @@
-power10: strcmp fails to save and restore nonvolatile vector registers
-
-The Power 10 implementation of strcmp in
-sysdeps/powerpc/powerpc64/le/power10/strcmp.S failed to save/restore
-nonvolatile vector registers in the 32-byte aligned loop path.  This
-results in callers reading content from those registers in a different
-context, potentially altering program logic.
-
-There could be a program context where a user controlled string could
-leak through strcmp into program code, thus altering its logic.  There
-is also a potential for sensitive strings passed into strcmp leaking
-through the clobbered registers into parts of the calling program that
-should otherwise not have had access to those strings.
-
-The impact of this flaw is limited to applications running on Power 10
-hardware that use the nonvolatile vector registers, i.e. v20 to v31
-assuming that they have been treated in accordance with the OpenPower
-psABI.  It is possible to work around the issue for those specific
-applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like
-so:
-
-    export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1
-
-CVE-Id: CVE-2025-5702
-Public-Date: 2025-06-04
-Vulnerable-Commit: 3367d8e180848030d1646f088759f02b8dfe0d6f (2.39)
-Fix-Commit: 15808c77b35319e67ee0dc8f984a9a1a434701bc (2.42)
-Fix-Commit: 0c76c951620f9e12df2a89b2c684878b55bb6795 (2.41-60)
-Fix-Commit: 7e12550b8e3a11764a4a9090ce6bd3fc23fc8a8e (2.40-139)
-Fix-Commit: 06a70769fd0b2e1f2a3085ad50ab620282bd77b3 (2.39-209)
diff --git a/advisories/GLIBC-SA-2025-0004 b/advisories/GLIBC-SA-2025-0004
deleted file mode 100644
index 9409ca27c4..0000000000
--- a/advisories/GLIBC-SA-2025-0004
+++ /dev/null
@@ -1,29 +0,0 @@
-power10: strncmp fails to save and restore nonvolatile vector registers
-
-The Power 10 implementation of strncmp in
-sysdeps/powerpc/powerpc64/le/power10/strncmp.S failed to save/restore
-nonvolatile vector registers in the 32-byte aligned loop path.  This
-results in callers reading content from those registers in a different
-context, potentially altering program logic.
-
-There could be a program context where a user controlled string could
-leak through strncmp into program code, thus altering its logic.  There
-is also a potential for sensitive strings passed into strncmp leaking
-through the clobbered registers into parts of the calling program that
-should otherwise not have had access to those strings.
-
-The impact of this flaw is limited to applications running on Power 10
-hardware that use the nonvolatile vector registers, i.e. v20 to v31
-assuming that they have been treated in accordance with the OpenPower
-psABI.  It is possible to work around the issue for those specific
-applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like
-so:
-
-    export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1
-
-CVE-Id: CVE-2025-5745
-Public-Date: 2025-06-05
-Vulnerable-Commit: 23f0d81608d0ca6379894ef81670cf30af7fd081 (2.40)
-Fix-Commit: 63c60101ce7c5eac42be90f698ba02099b41b965 (2.42)
-Fix-Commit: 84bdbf8a6f2fdafd3661489dbb7f79835a52da82 (2.41-57)
-Fix-Commit: 42a5a940c974d02540c8da26d6374c744d148cb9 (2.40-136)
diff --git a/advisories/GLIBC-SA-2025-0005 b/advisories/GLIBC-SA-2025-0005
deleted file mode 100644
index 8bcccc59a5..0000000000
--- a/advisories/GLIBC-SA-2025-0005
+++ /dev/null
@@ -1,14 +0,0 @@
-posix: Fix double-free after allocation failure in regcomp
-
-The regcomp function in the GNU C library version from 2.4 to 2.41 is
-subject to a double free if some previous allocation fails. It can be
-accomplished either by a malloc failure or by using an interposed
-malloc that injects random malloc failures. The double free can allow
-buffer manipulation depending of how the regex is constructed.
-This issue affects all architectures and ABIs supported by the GNU C
-library.
-
-CVE-Id: CVE-2025-8058
-Public-Date: 2025-07-22
-Vulnerable-Commit: 963d8d782fc98fb6dc3a66f0068795f9920c269d (2.3.3-1596)
-Fix-Commit: 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d (2.42)
diff --git a/advisories/GLIBC-SA-2026-0001 b/advisories/GLIBC-SA-2026-0001
deleted file mode 100644
index 3e0ee3b3f4..0000000000
--- a/advisories/GLIBC-SA-2026-0001
+++ /dev/null
@@ -1,41 +0,0 @@
-Integer overflow in memalign leads to heap corruption
-
-Passing too large an alignment to the memalign suite of functions
-(memalign, posix_memalign, aligned_alloc) in the GNU C Library version
-2.30 to 2.42 may result in an integer overflow, which could consequently
-result in a heap corruption.
-
-Note that the attacker must have control over both, the size as well as
-the alignment arguments of the memalign function to be able to exploit
-this.  The size parameter must be close enough to PTRDIFF_MAX so as to
-overflow size_t along with the large alignment argument.  This limits
-the malicious inputs for the alignment for memalign to the range [1<<62
-+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.
-
-Typically the alignment argument passed to such functions is a known
-constrained quantity (e.g. page size, block size, struct sizes) and is
-not attacker controlled, because of which this may not be easily
-exploitable in practice.  An application bug could potentially result in
-the input alignment being too large, e.g. due to a different buffer
-overflow or integer overflow in the application or its dependent
-libraries, but that is again an uncommon usage pattern given typical
-sources of alignments.
-
-CVE-Id: CVE-2026-0861
-Public-Date: 2026-01-14
-Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206 (2.30)
-Fix-Commit: c9188d333717d3ceb7e3020011651f424f749f93 (2.43)
-Fix-Commit: 7f19ef14fbce095d4c77395e258320cad2ea2b28 (2.30-153)
-Fix-Commit: f18446d7b4a423090ee5e328c36b3c2a0f26041c (2.31-166)
-Fix-Commit: 8aef9e7a7af9565c0324b4ecb38b30dfa3782fd8 (2.32-151)
-Fix-Commit: 011293b4fd748cdd6f95874ba2b6aba9a3df8bff (2.33-275)
-Fix-Commit: 2c77e52108a58956c9f674b36e1f59a4e3fdcf4d (2.34-525)
-Fix-Commit: 499d1ccafccfe64df1b88deea2fa84d8180e8e8f (2.35-399)
-Fix-Commit: fb6b8822175769b5794fb6ea04f2895483a29b61 (2.36-244)
-Fix-Commit: 7b913d41a07836def826f2164c52541a9835f324 (2.37-172)
-Fix-Commit: 744b63026a29f7eedbbc8e3a01a7f48a6eb0a085 (2.38-212)
-Fix-Commit: fb22fd3f5b415dd4cd6f7b5741c2f0412374e242 (2.39-286)
-Fix-Commit: bfc4dd9e526eacf3017dd8864ba0848e9d045dd4 (2.40-216)
-Fix-Commit: 1e2c1ea4307197ccece0cda574bcfebf9080894c (2.41-121)
-Fix-Commit: b0ec8fb689df862171f0f78994a3bdeb51313545 (2.42-49)
-Reported-by: Igor Morgenstern, Aisle Research
diff --git a/advisories/GLIBC-SA-2026-0002 b/advisories/GLIBC-SA-2026-0002
deleted file mode 100644
index f10d8362f6..0000000000
--- a/advisories/GLIBC-SA-2026-0002
+++ /dev/null
@@ -1,36 +0,0 @@
-getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
-
-Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf
-that specifies the library's DNS backend for networks and queries for a
-zero-valued network in the GNU C Library version 2.0 to version 2.42
-can leak stack contents to the configured DNS resolver.
-
-A defect in the _nss_dns_getnetbyaddr_r function which implements
-getnetbyaddr and getnetbyaddr_r in the dns-based network database can
-pass stack contents unmodified to the configured DNS resolver as part of
-the network DNS query when the network queried is the default network
-i.e. net == 0x0.  This stack contents leaking in the query is considered
-a loss of confidentiality for the host making the query.  Typically it
-is rare to call these APIs with a net value of zero, and if an attacker
-can control the net value it can only leak adjacent stack, and so loss
-of confidentiality is spatially limited.  The leak might be used to
-accelerate an ASLR bypass by knowing pointer values, but also requires
-network adjacent access to snoop between the application and the
-DNS server; making the attack complexity higher.
-
-CVE-Id: CVE-2026-0915
-Public-Date: 2026-01-15
-Vulnerable-Commit: 5f0e6fc702296840d2daa39f83f6cb1e40073d58 (1.92-1)
-Fix-Commit: e56ff82d5034ec66c6a78f517af6faa427f65b0b (2.43)
-Fix-Commit: 453e6b8dbab935257eb0802b0c97bca6b67ba30e (2.42-50)
-Fix-Commit: 15c9839a0b853f552b4ed9047841b6223f3c104d (2.41-122)
-Fix-Commit: 329c775788b2c9ff3da774ccf59fba7b6b8ff08e (2.40-217)
-Fix-Commit: 831f63b94ceb92fb14c0d1a7ddad35a0d1404c71 (2.39-287)
-Fix-Commit: 49125ffc8e1674dc2a100dfdc5b78796f22e16f2 (2.38-213)
-Fix-Commit: ddcaed5dfb05b2c1a6ea842fd6b643501365450a (2.37-173)
-Fix-Commit: a6bf47887f24b2b394acb301a3189fda04bd4d4d (2.36-245)
-Fix-Commit: 66f0cb057c9b4fb1249a5fec6ef4a63511a37899 (2.35-400)
-Fix-Commit: 96863dee262225cfb79f9fe45e06fd188319c7b8 (2.34-526)
-Fix-Commit: d210011f1536c8322157cbb4fe4229b35c834c08 (2.33-276)
-Fix-Commit: 1bc1832cfc74c2a601220969f36e789a5e9f0ebe (2.32-152)
-Reported-by: Igor Morgenstern, Aisle Research
diff --git a/advisories/GLIBC-SA-2026-0003 b/advisories/GLIBC-SA-2026-0003
deleted file mode 100644
index b7a6e83a10..0000000000
--- a/advisories/GLIBC-SA-2026-0003
+++ /dev/null
@@ -1,36 +0,0 @@
-wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
-
-Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the
-GNU C Library version 2.0 to version 2.42 may cause the interface to
-return uninitialized memory in the we_wordv member, which on subsequent
-calls to wordfree may abort the process.
-
-The implementation of WRDE_REUSE in conjunction with WRDE_APPEND fails
-to clear the we_wordc member of the structure, and as such, when new
-words are added internally, a leading we_wordc count number of entries
-are skipped since they are assumed initialized.  These skipped entries
-are not initialized, but are the contents of a realloc-expanded array of
-pointers.  If the caller inspects the we_wordv array, it will
-dereference invalid pointers and crash. If the caller calls wordfree,
-the malloc implementation may detect the invalid pointers and abort the
-process.  Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never
-worked correctly and thus the existence of applications that make use of
-this feature is unlikely.
-
-CVE-Id: CVE-2025-15281
-Public-Date: 2026-01-20
-Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260)
-Fix-Commit: 80cc58ea2de214f85b0a1d902a3b668ad2ecb302 (2.43)
-Fix-Commit: cbf39c26b25801e9bc88499b4fd361ac172d4125 (2.42-51)
-Fix-Commit: fb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 (2.41-123)
-Fix-Commit: 9fe8576664d43b87ca19401fb6a975e217e47623 (2.40-218)
-Fix-Commit: ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc (2.39-288)
-Fix-Commit: d5409a1be010699794264162c551ba60f05ee6c3 (2.38-214)
-Fix-Commit: ff2b172803f6bbd897755d2ce83ec4323a1a15b3 (2.37-174)
-Fix-Commit: e97cfe2293ed097eb3d0b4c18274d22855e65130 (2.36-246)
-Fix-Commit: bb59339d02faebac534a87eea50c83c948f35b77 (2.35-401)
-Fix-Commit: 2b656ff94d72f93c84d8da2e7c76456c1994f02e (2.34-527)
-Fix-Commit: 1d8ed2067a8a5d162a07670d0d063429679f17a0 (2.33-277)
-Fix-Commit: 3a56c4ee4ea49b8f2391a2d8d6220013c4160a79 (2.32-153)
-Fix-Commit: 28eb5caf895ced5d895cb02757e109004a2d33e5 (2.31-167)
-Reported-by: Vitaly Simonovich
diff --git a/advisories/GLIBC-SA-2026-0004 b/advisories/GLIBC-SA-2026-0004
deleted file mode 100644
index fd630dc591..0000000000
--- a/advisories/GLIBC-SA-2026-0004
+++ /dev/null
@@ -1,30 +0,0 @@
-nscd client crash on x86_64 under high nscd load
-
-Calling NSS-backed functions that support caching via nscd may call the
-nscd client side code and in the GNU C Library version 2.36 under high
-load on x86_64 systems, the client may call memcmp on inputs that are
-concurrently modified by other processes or threads and crash.
-
-The nscd client in the GNU C Library uses the memcmp function with
-inputs that may be concurrently modified by another thread, potentially
-resulting in spurious cache misses, which in itself is not a security
-issue.  However in the GNU C Library version 2.36 an optimized
-implementation of memcmp was introduced for x86_64 which could crash
-when invoked with such undefined behaviour, turning this into a
-potential crash of the nscd client and the application that uses it.
-This implementation was backported to the 2.35 branch, making the nscd
-client in that branch vulnerable as well.  Subsequently, the fix for
-this issue was backported to all vulnerable branches in the GNU C
-Library repository.
-
-It is advised that distributions that may have cherry-picked the memcpy
-SSE2 optimization in their copy of the GNU C Library, also apply the fix
-to avoid the potential crash in the nscd client.
-
-CVE-Id: CVE-2026-3904
-Public-Date: 2026-03-11
-Vulnerable-Commit: 8804157ad9da39631703b92315460808eac86b0c (2.36)
-Vulnerable-Commit: 5a8df6485c584e2b0e957ec6b9070437a724911a (2.35-89)
-Fix-Commit: b712be52645282c706a5faa038242504feb06db5 (2.37)
-Fix-Commit: 93967a2a7bbdcedb73e0b246713580c7c84d001e (2.36-84)
-Fix-Commit: 6bcd5d8e3668d52388a6e0580611749f93e6871f (2.35-230)
diff --git a/advisories/GLIBC-SA-2026-0005 b/advisories/GLIBC-SA-2026-0005
deleted file mode 100644
index 7a50a43263..0000000000
--- a/advisories/GLIBC-SA-2026-0005
+++ /dev/null
@@ -1,37 +0,0 @@
-gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
-
-Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf
-that specifies the library's DNS backend in the GNU C Library version
-2.34 to version 2.43 could, with a crafted response from the configured
-DNS server, result in a violation of the DNS specification that causes
-the application to treat a non-answer section of the DNS response as a
-valid answer.
-
-A defect in the getanswer_ptr function, which implements the iteration
-and extraction of the answer from the DNS response, can cause it to
-incorrectly transition from the answer section to the next section while
-still treating it as an answer to the question.  This can happen when
-the answer contains only skipped records, and the subsequent section
-contains a semantically invalid T_PTR record.  This is considered a
-security issue because it is a violation of the DNS specification that
-leads to incorrect behaviour that could result in the wrong hostname
-being returned to the caller.  At the time of publication, no known
-affected DNS server returns results that would be incorrectly
-interpreted by the library.  An attacker would either need to be network
-adjacent or have compromised the DNS server to use this defect to hide
-returned reverse DNS results from intrusion detection systems. Even
-then, the inbound connection from the attacker, or the outbound
-connection from the application, would be visible to the intrusion
-detection system.  At best, the defect can be used to obfuscate and
-delay analysis of the evolving threat.
-
-CVE-Id: CVE-2026-4437
-Public-Date: 2026-03-20
-Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323)
-Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188)
-Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30)
-Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37)
-Fix-Commit: 5c6fca0c62ce5bd6e68e259f138097756cbafd4d (2.43-16)
-Fix-Commit: 9f5f18aab40ec6b61fa49a007615e6077e9a979b (2.44)
-Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
-Reported-by: Kevin Farrell
diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006
deleted file mode 100644
index 1ac70de4d9..0000000000
--- a/advisories/GLIBC-SA-2026-0006
+++ /dev/null
@@ -1,27 +0,0 @@
-gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
-
-Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf
-that specifies the library's DNS backend in the GNU C library version
-2.34 to version 2.43 could result in an invalid DNS hostname being
-returned to the caller in violation of the DNS specification.
-
-A defect in the getanswer_ptr function, which implements the iteration
-and extraction of the answer from a DNS response, can cause it to accept
-an invalid DNS hostname that can contain shell metacharacters. An
-application that uses the returned hostname in a shell, without guarding
-for shell expansion, may be subject to shell injection attacks.  At the
-time of publication, no known affected DNS server returns results with
-shell metacharacters in the results.  An attacker would either need to
-be network adjacent or have compromised the DNS server to use this
-defect for shell injection.  No known vulnerable application has been
-identified.
-
-CVE-Id: CVE-2026-4438
-Public-Date: 2026-03-20
-Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323)
-Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188)
-Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30)
-Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37)
-Fix-Commit: dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718 (2.43-17)
-Fix-Commit: e10977481f4db4b2a3ce34fa4c3a1e26651ae312 (2.44)
-Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
diff --git a/advisories/GLIBC-SA-2026-0007 b/advisories/GLIBC-SA-2026-0007
deleted file mode 100644
index b880fb5544..0000000000
--- a/advisories/GLIBC-SA-2026-0007
+++ /dev/null
@@ -1,15 +0,0 @@
-iconv crash due to assertion failure with untrusted input
-
-The iconv() function in the GNU C Library versions 2.43 and earlier may
-crash due to an assertion failure when converting inputs from the
-IBM1390 or IBM1399 character sets, which may be used to remotely crash
-an application.
-
-This vulnerability can be trivially mitigated by removing the IBM1390
-and IBM1399 character sets from systems that do not need them.
-
-CVE-Id: CVE-2026-4046
-Public-Date: 2026-03-12
-Vulnerable-Commit: 0ecb606cb6cf65de1d9fc8a919bceb4be476c602 (2.3.3-1501)
-Fix-Commit: d6f08d1cf027f4eb2ba289a6cc66853722d4badc (2.44)
-Reported-by: Rocket Ma
diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008
deleted file mode 100644
index 43b38ce38a..0000000000
--- a/advisories/GLIBC-SA-2026-0008
+++ /dev/null
@@ -1,22 +0,0 @@
-REJECTED: Static buffer overflow in deprecated nis_local_principal
-
-REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been
-discovered that no NIS+ client or server was ever released for any
-Linux-based OS distributions and as such this makes the API provisional
-and unused.  Secondly it has been discovered that the NIS+ cold start
-cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API
-can only be called with a trusted server from the pre-populated cache.
-The use of a trusted server means no trust boundary is crossed and this
-is therefore considered a normal bug.
-
-NIS+ support in the GNU C Library was never officially supported even
-though an incomplete implementation of the APIs was made pulibc.  To the
-best knowledge of the glibc security team no open-source NIS+ server
-implementations were ever released for use with this API.  Applications
-should not use any of the NIS+ APIs and should move to modern identity
-and access management services.
-
-CVE-Id: CVE-2026-5358
-Public-Date: 2026-04-10
-Rejected-Date: 2026-04-33
-Reported-by: Rahul Hoysala
diff --git a/advisories/GLIBC-SA-2026-0009 b/advisories/GLIBC-SA-2026-0009
deleted file mode 100644
index 3c297fdc80..0000000000
--- a/advisories/GLIBC-SA-2026-0009
+++ /dev/null
@@ -1,23 +0,0 @@
-scanf %mc off-by-one heap buffer overflow
-
-Calling the scanf family of functions with a %mc (malloc'd character
-match) in the GNU C Library version 2.7 to version 2.43 with a format
-width specifier with an explicit width greater than 1024 could result in
-a one byte heap buffer overflow.
-
-The bug is in the buffer growth formula in __vfscanf_internal, which
-under-allocates by one byte during realloc expansion, allowing a
-controlled single-byte overwrite past the end of the heap buffer.
-
-The impact is limited by the fact that to execute the overwrite you need
-both user controlled input data and a specific choice of maximum width
-that yields a smaller than needed allocation. The latter point has to
-take into account malloc's particular chunk size rounding process.  The
-"%[width]mc" format specifier does not appear to have notable use in
-major Linux-based OS distributions, due to which the real world impact
-may be limited to bespoke use cases.
-
-CVE-Id: CVE-2026-5450
-Public-Date: 2026-03-19
-Vulnerable-Commit: 874aa52349cc111d1f6ea5dff24bb14c306714e0 (2.7)
-Reported-by: Rocket Ma
diff --git a/advisories/GLIBC-SA-2026-0010 b/advisories/GLIBC-SA-2026-0010
deleted file mode 100644
index ae9953fb71..0000000000
--- a/advisories/GLIBC-SA-2026-0010
+++ /dev/null
@@ -1,24 +0,0 @@
-Potential buffer under-read in ungetwc
-
-Calling the ungetwc function on a FILE stream with wide characters
-encoded in a character set that has overlaps between its single byte and
-multi-byte character encodings, in the GNU C Library version 2.43 or
-earlier, may result in an attempt to read bytes before an allocated
-buffer, potentially resulting in unintentional disclosure of neighboring
-data in the heap, or a program crash.
-
-A bug in the wide character pushback implementation
-(_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate
-on the regular character buffer (fp->_IO_read_ptr) instead of the actual
-wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program
-crash may happen in cases where fp->_IO_read_ptr is not initialized and
-hence points to NULL. The buffer under-read requires a special situation
-where the input character encoding is such that there are overlaps
-between single byte representations and multibyte representations in
-that encoding, resulting in spurious matches.  The spurious match case
-is not possible in the standard Unicode character sets.
-
-CVE-Id: CVE-2026-5928
-Public-Date: 2026-03-17
-Reported-by: Rocket Ma
-Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89)
diff --git a/advisories/GLIBC-SA-2026-0011 b/advisories/GLIBC-SA-2026-0011
deleted file mode 100644
index e492fa5507..0000000000
--- a/advisories/GLIBC-SA-2026-0011
+++ /dev/null
@@ -1,24 +0,0 @@
-Potential buffer overflow in ns_sprintrrf TSIG handling path
-
-The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
-GNU C Library version 2.2 and newer fail to enforce the caller-supplied
-buffer length, and can result in an out-of-bounds write when printing
-TSIG records.
-
-A defect in the TSIG case handling within ns_sprintrrf performs a
-formatted write using sprintf without checking the remaining buffer
-length, and may write up to 6 bytes past the end of the buffer.  If the
-library is compiled with assertions, and the out-of-bounds write doesn't
-terminate the process, then a subsequent check for "len <= *buflen" will
-trigger an assertion failure.
-
-These functions are for application debugging only and hence not in the
-path of code executed by the DNS resolver. Further, they have been
-deprecated since version 2.34 (2021-08-02) and should not be used by any
-new applications.  Applications should consider porting away from these
-interfaces since they may be removed in future versions.
-
-CVE-Id: CVE-2026-5435
-Public-Date: 2026-04-02
-Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2)
-Reported-by: shinobu
diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012
deleted file mode 100644
index 22071d97a6..0000000000
--- a/advisories/GLIBC-SA-2026-0012
+++ /dev/null
@@ -1,18 +0,0 @@
-Buffer overread in ns_printrrf with corrupted RDATA field
-
-The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
-GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA
-content against the RDATA length in a DNS response when processing A6,
-CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a
-DNS response, causing a target application to crash or read
-uninitialized memory.
-
-These functions are for application debugging only and hence not in the
-path of code executed by the DNS resolver.  Further, they have been
-deprecated since version 2.34 and should not be used by any new
-applications.  Applications should consider porting away from these
-interfaces since they may be removed in future versions.
-
-CVE-Id: CVE-2026-6238
-Public-Date: 2026-04-11
-Vulnerable-Commit: ee188d555b8c32ad9704a7440cab400af967292f (1.90)
diff --git a/advisories/GLIBC-SA-2026-0013 b/advisories/GLIBC-SA-2026-0013
deleted file mode 100644
index 085a853434..0000000000
--- a/advisories/GLIBC-SA-2026-0013
+++ /dev/null
@@ -1,20 +0,0 @@
-Potential stack-based buffer clash during tilde expansion in wordexp
-
-Calling wordexp with a tilde (~) followed by an overly long username
-in the GNU C Library version 2.2.3 to 2.43 may lead to a stack buffer
-clash.
-
-When expanding paths that begin with a tilde (~) followed by a username, the
-internal parse_tilde function extracts the username to determine the user's
-home directory.  The implementation allocates memory for this username directly
-on the stack using the strndupa macro.  Because the size of this allocation
-was determined by the length of the user-supplied input without any bounds
-checks, passing an excessively long username e.g. thousands of characters,
-forces the thread to exhaust its stack space. Thus if an application passes
-untrusted, attacker-controlled input to the wordexp function, an attacker
-can trigger a stack clash.
-
-CVE-Id: CVE-2026-6791
-Public-Date: 2026-06-22
-Vulnerable-Commit: 344af000e1d6e9c7882b9bc48e71cb3f1b5fc03c (2.2.3-114)
-Reported-by: storm
diff --git a/advisories/GLIBC-SA-2026-0014 b/advisories/GLIBC-SA-2026-0014
deleted file mode 100644
index 1e9a0039f0..0000000000
--- a/advisories/GLIBC-SA-2026-0014
+++ /dev/null
@@ -1,19 +0,0 @@
-wordexp with WRDE_APPEND may result in an invalid call to free()
-
-Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion
-(where an error like WRDE_BADCHAR would be returned) can create a stale
-address in the wordexp_t that can cause an invalid free from wordfree.
-This affects the GNU C Library version 2.0 to version 2.43.
-
-In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state
-before appending the processing input.  If the word expansion grows
-we_wordv via realloc, and realloc requires moving we_wordv to a new memory
-location (instead of expanding in-place), and the expansion later fails,
-the rollback fails to properly restore all previous we_wordv values and
-may add stale pointers into the caller-visible state.  A subsequent
-wordfree may then issue an invalid call to free().
-
-CVE-Id: CVE-2026-6368
-Public-Date: 2026-07-14
-Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260)
-Reported-by: shinobu
diff --git a/advisories/README b/advisories/README
deleted file mode 100644
index 330a31dff3..0000000000
--- a/advisories/README
+++ /dev/null
@@ -1,92 +0,0 @@
-GNU C Library Security Advisory Format
-======================================
-
-Security advisories in this directory follow a simple git commit log
-format, with a heading and free-format description augmented with tags
-to allow parsing key information.  References to code changes are
-specific to the glibc repository and follow a specific format:
-
-  Tag-name: <commit-ref> (release-version)
-
-The <commit-ref> indicates a specific commit in the repository.  The
-release-version indicates the publicly consumable release in which this
-commit is known to exist.  The release-version is derived from the
-git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and
-is of the form 2.34-NNN.  If the -NNN suffix is absent, it means that
-the change is in that release tarball, otherwise the change is on the
-release/2.YY/master branch and not in any released tarball.
-
-The following tags are currently being used:
-
-CVE-Id:
-This is the CVE-Id assigned under the CVE Program
-(https://www.cve.org/).
-
-Public-Date:
-The date this issue became publicly known.
-
-Rejected-Date:
-The most recent date the assigned advisory was rejected. If the advisory
-is ever published again the Rejected-Date tag should be removed.
-
-Vulnerable-Commit:
-The commit that introduced this vulnerability.  There could be multiple
-entries, one for each release branch in the glibc repository; the
-release-version portion of this tag should tell you which branch this is
-on.
-
-Fix-Commit:
-The commit that fixed this vulnerability.  There could be multiple
-entries for each release branch in the glibc repository, indicating that
-all of those commits contributed to fixing that issue in each of those
-branches.
-
-Reported-By:
-The entity that reported this issue. There could be multiple entries, one for
-each reporter.
-
-Adding an Advisory
-------------------
-
-An advisory for a CVE needs to be added on the master branch in two steps:
-
-1. Add the text of the advisory without any Fix-Commit tags along with
-   the fix for the CVE.  Add the Vulnerable-Commit tag, if applicable.
-   The advisories directory does not exist in release branches, so keep
-   the advisory text commit distinct from the code changes, to ease
-   backports.  Ask for the GLIBC-SA advisory number from the security
-   team.
-
-2. Finish all backports on release branches and then back on the msater
-   branch, add all commit refs to the advisory using the Fix-Commit
-   tags.  Don't bother adding the release-version subscript since the
-   next step will overwrite it.
-
-3. Run the process-advisories.sh script in the scripts directory on the
-   advisory:
-
-     scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN
-
-   (replace YYYY-NNNN with the actual advisory number).
-
-4. Verify the updated advisory and push the result.
-
-Rejecting an Advisory
----------------------
-
-Rejecting an advisory on the master branch can be done in one step:
-
-1. Mark the advisory as rejected. Add the text "REJECTED: " as a prefix
-   to any short-form description. Add a new paragraph that starts with
-   "REJECTED: " and explains the reason for the rejection including
-   justification for why it no longer has security impact.  Lastly add
-   a Rejected-Date tag to the advisory.
-
-Getting a NEWS snippet from advisories
---------------------------------------
-
-Run:
-
-  scripts/process-advisories.sh news
-
-and copy the content into the NEWS file.

commit 1bd79651065b27c02c6502b9423124e54882058d
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Jul 25 09:21:33 2026 +0900

    NEWS: start 2.44.1 section
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

diff --git a/NEWS b/NEWS
index ee28fadf49..1043343d70 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ See the end for copying conditions.
 Please send GNU C library bug reports via <https://sourceware.org/bugzilla/>
 using `glibc' in the "product" field.
 
+Version 2.44.1
+
+The following bugs are resolved with this release:
+
 Version 2.44
 
 Major new features:

commit 0b05bc142249ac47e72be5cad5c37f33f4bb68d4
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Fri Jul 24 23:10:02 2026 +0200

    hurd: Make the readlink __fstatat64 references optional
    
    They may show up or not depending on the toolchain in use.

diff --git a/sysdeps/mach/hurd/i386/localplt.data b/sysdeps/mach/hurd/i386/localplt.data
index 2befcd3748..5b9413422d 100644
--- a/sysdeps/mach/hurd/i386/localplt.data
+++ b/sysdeps/mach/hurd/i386/localplt.data
@@ -25,14 +25,14 @@ ld.so: __writev
 ld.so: __libc_lseek64
 ld.so: __mmap
 ld.so: __fstat64
-ld.so: __fstatat64
+ld.so: __fstatat64 ?
 ld.so: __stat64
 ld.so: __access
 ld.so: __getpid
 ld.so: __getcwd
 ld.so: _exit ?
 ld.so: abort
-ld.so: readlink
+ld.so: readlink ?
 ld.so: _hurd_intr_rpc_mach_msg
 ld.so: __errno_location
 ld.so: _dl_init_first
diff --git a/sysdeps/mach/hurd/x86_64/localplt.data b/sysdeps/mach/hurd/x86_64/localplt.data
index fda28cd983..cc39118d12 100644
--- a/sysdeps/mach/hurd/x86_64/localplt.data
+++ b/sysdeps/mach/hurd/x86_64/localplt.data
@@ -24,14 +24,14 @@ ld.so: __writev
 ld.so: __libc_lseek64
 ld.so: __mmap
 ld.so: __fstat64
-ld.so: __fstatat64
+ld.so: __fstatat64 ?
 ld.so: __stat64
 ld.so: __access
 ld.so: __getpid
 ld.so: __getcwd
 ld.so: _exit ?
 ld.so: abort
-ld.so: readlink
+ld.so: readlink ?
 ld.so: _hurd_intr_rpc_mach_msg
 ld.so: __errno_location
 ld.so: _dl_init_first

commit c045fc61e8435c103ebfe06d01fec7f56503e2b4
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Mon Jul 27 00:59:36 2026 +0200

    hurd: fix fork's longjmp demangling on i386
    
    i386's setjmp does not actually mangle ebp.

diff --git a/sysdeps/mach/hurd/i386/longjmp-ts.c b/sysdeps/mach/hurd/i386/longjmp-ts.c
index 93450e86b4..340104b832 100644
--- a/sysdeps/mach/hurd/i386/longjmp-ts.c
+++ b/sysdeps/mach/hurd/i386/longjmp-ts.c
@@ -38,7 +38,6 @@ _hurd_longjmp_thread_state (void *state, jmp_buf env, int val)
   ts->eip = env[0].__jmpbuf[JB_PC];
   ts->eax = val ?: 1;
 
-  PTR_DEMANGLE (ts->ebp);
   PTR_DEMANGLE (ts->uesp);
   PTR_DEMANGLE (ts->eip);
 }

commit 7cba77790f3279bec3ac20e9c7632b021cd53f95
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Jul 27 13:37:19 2026 -0300

    math: Fix sinh worst-case results for |x| > 36.736801 [BZ 34441]
    
    The CORE-MATH import mistranslated the accurate path result scaling
    'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed68), and two of
    the 51 exceptional-case table entries were dropped when the table was
    moved to e_sinh_data.c (commit f05c4907a27).
    
    Checked on x86_64-linux-gnu and aarch64-linux-gnu.
    
    (cherry picked from commit fdc90dbb52b092f68cd5a4fac7a4cbd854c91bc3)

diff --git a/NEWS b/NEWS
index 1043343d70..fe2b1d7f79 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ using `glibc' in the "product" field.
 Version 2.44.1
 
 The following bugs are resolved with this release:
+
+  [34441] math: math: sinh() returns wrong results for some inputs with
+    |x| > 36.736801
 
 Version 2.44
 
diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in
index ca670768a2..5c4d486af4 100644
--- a/math/auto-libm-test-in
+++ b/math/auto-libm-test-in
@@ -9661,6 +9661,14 @@ sinh 0x2.c5d37700c6bb03a6c24b6c9b494cp+12
 sinh 0x2.c5d37700c6bb03a6c24b6c9b494ep+12
 # the next value generates larger error bounds on x86_64 (binary64)
 sinh -0x1.633c62890fa14p+9
+sinh 0x1.2b4f4e0bb49c9p+5
+sinh -0x1.2b4f4e0bb49c9p+5
+sinh 0x1.2ac43fb6d3abap+5
+sinh -0x1.2ac43fb6d3abap+5
+sinh 0x1.b7efa91915c95p-2
+sinh -0x1.b7efa91915c95p-2
+sinh 0x1.92a5c27afbe82p+4
+sinh -0x1.92a5c27afbe82p+4
 
 sinpi 0
 sinpi -0
diff --git a/math/auto-libm-test-out-sinh b/math/auto-libm-test-out-sinh
index f96252b91c..91ab5c19fa 100644
--- a/math/auto-libm-test-out-sinh
+++ b/math/auto-libm-test-out-sinh
@@ -6466,3 +6466,555 @@ sinh -0x1.633c62890fa14p+9
 = sinh tonearest ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok
 = sinh towardzero ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok
 = sinh upward ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok
+sinh 0x1.2b4f4e0bb49c9p+5
+= sinh downward binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok
+= sinh tonearest binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok
+= sinh towardzero binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok
+= sinh upward binary32 0x2.569eap+4 : 0x1.f7c30cp+52 : inexact-ok
+= sinh downward binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok
+= sinh tonearest binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok
+= sinh towardzero binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok
+= sinh upward binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok
+= sinh downward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh tonearest intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh towardzero intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh upward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh downward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh tonearest m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh towardzero m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh upward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh downward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh tonearest binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh towardzero binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh upward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok
+= sinh downward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok
+= sinh tonearest ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok
+= sinh upward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok
+= sinh downward binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok
+= sinh tonearest binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok
+= sinh towardzero binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok
+= sinh upward binary32 0x2.569e9cp+4 : 0x1.f7c28ep+52 : inexact-ok
+= sinh downward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok
+= sinh tonearest binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok
+= sinh towardzero binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok
+= sinh upward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok
+= sinh downward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh tonearest intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh towardzero intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh upward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok
+= sinh downward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh tonearest m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh towardzero m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh upward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok
+= sinh downward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh tonearest binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh towardzero binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh upward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok
+= sinh downward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok
+= sinh tonearest ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok
+= sinh upward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok
+= sinh downward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok
+= sinh tonearest binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok
+= sinh towardzero binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok
+= sinh upward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok
+= sinh downward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh tonearest intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh towardzero intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh upward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok
+= sinh downward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh tonearest m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh towardzero m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh upward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok
+= sinh downward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok
+= sinh tonearest binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok
+= sinh towardzero binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok
+= sinh upward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok
+= sinh downward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+= sinh tonearest ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+= sinh upward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok
+sinh -0x1.2b4f4e0bb49c9p+5
+= sinh downward binary32 -0x2.569e9cp+4 : -0x1.f7c28ep+52 : inexact-ok
+= sinh tonearest binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok
+= sinh towardzero binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok
+= sinh upward binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok
+= sinh downward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok
+= sinh tonearest binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok
+= sinh towardzero binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok
+= sinh upward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok
+= sinh downward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok
+= sinh tonearest intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh towardzero intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh upward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh downward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh upward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok
+= sinh downward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok
+= sinh tonearest binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh towardzero binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh upward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok
+= sinh downward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok
+= sinh upward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok
+= sinh downward binary32 -0x2.569eap+4 : -0x1.f7c30cp+52 : inexact-ok
+= sinh tonearest binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok
+= sinh towardzero binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok
+= sinh upward binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok
+= sinh downward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok
+= sinh tonearest binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok
+= sinh towardzero binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok
+= sinh upward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok
+= sinh downward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh tonearest intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh towardzero intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh upward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh downward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh upward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok
+= sinh downward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok
+= sinh tonearest binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh towardzero binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh upward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok
+= sinh downward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok
+= sinh upward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok
+= sinh downward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok
+= sinh tonearest binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok
+= sinh towardzero binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok
+= sinh upward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok
+= sinh downward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok
+= sinh tonearest intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh towardzero intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh upward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh downward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh upward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok
+= sinh downward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok
+= sinh tonearest binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok
+= sinh towardzero binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok
+= sinh upward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok
+= sinh downward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+= sinh upward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok
+sinh 0x1.2ac43fb6d3abap+5
+= sinh downward binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok
+= sinh tonearest binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok
+= sinh towardzero binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok
+= sinh upward binary32 0x2.55888p+4 : 0x1.d6b0eep+52 : inexact-ok
+= sinh downward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh tonearest binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh towardzero binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh upward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c3p+52 : inexact-ok
+= sinh downward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh tonearest intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh towardzero intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh upward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok
+= sinh downward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh tonearest m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh towardzero m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh upward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok
+= sinh downward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh tonearest binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh towardzero binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh upward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok
+= sinh downward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok
+= sinh tonearest ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok
+= sinh upward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok
+= sinh downward binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok
+= sinh tonearest binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok
+= sinh towardzero binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok
+= sinh upward binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok
+= sinh downward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh tonearest binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh towardzero binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh upward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b3p+52 : inexact-ok
+= sinh downward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh tonearest intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh towardzero intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh upward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok
+= sinh downward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh tonearest m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh towardzero m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh upward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok
+= sinh downward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh tonearest binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh towardzero binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh upward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok
+= sinh downward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok
+= sinh tonearest ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok
+= sinh upward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok
+= sinh downward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok
+= sinh tonearest binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok
+= sinh upward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh downward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh tonearest intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh upward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh downward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh tonearest m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh upward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh downward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh tonearest binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh towardzero binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh upward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok
+= sinh downward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+= sinh tonearest ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+= sinh towardzero ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+= sinh upward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok
+sinh -0x1.2ac43fb6d3abap+5
+= sinh downward binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok
+= sinh tonearest binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok
+= sinh towardzero binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok
+= sinh upward binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok
+= sinh downward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b3p+52 : inexact-ok
+= sinh tonearest binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh towardzero binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh upward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok
+= sinh downward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok
+= sinh tonearest intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh towardzero intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh upward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh downward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh upward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok
+= sinh downward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok
+= sinh tonearest binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh towardzero binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh upward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok
+= sinh downward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok
+= sinh upward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok
+= sinh downward binary32 -0x2.55888p+4 : -0x1.d6b0eep+52 : inexact-ok
+= sinh tonearest binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok
+= sinh towardzero binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok
+= sinh upward binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok
+= sinh downward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c3p+52 : inexact-ok
+= sinh tonearest binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh towardzero binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh upward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok
+= sinh downward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok
+= sinh tonearest intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh towardzero intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh upward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh downward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh upward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok
+= sinh downward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok
+= sinh tonearest binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh towardzero binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh upward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok
+= sinh downward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok
+= sinh upward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok
+= sinh downward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh tonearest binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok
+= sinh upward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok
+= sinh downward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh tonearest intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh upward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh downward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh tonearest m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok
+= sinh towardzero m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh upward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok
+= sinh downward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok
+= sinh tonearest binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh towardzero binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh upward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok
+= sinh downward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok
+= sinh tonearest ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+= sinh towardzero ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+= sinh upward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok
+sinh 0x1.b7efa91915c95p-2
+= sinh downward binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok
+= sinh tonearest binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok
+= sinh towardzero binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok
+= sinh upward binary32 0x6.dfbea8p-4 : 0x7.1661bp-4 : inexact-ok
+= sinh downward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok
+= sinh tonearest binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok
+= sinh towardzero binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok
+= sinh upward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok
+= sinh downward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh tonearest intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh towardzero intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh upward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok
+= sinh downward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh tonearest m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh towardzero m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh upward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok
+= sinh downward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok
+= sinh tonearest binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok
+= sinh towardzero binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok
+= sinh upward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok
+= sinh downward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh tonearest ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh towardzero ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh upward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ecp-4 : inexact-ok
+= sinh downward binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok
+= sinh tonearest binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok
+= sinh towardzero binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok
+= sinh upward binary32 0x6.dfbeap-4 : 0x7.1661a8p-4 : inexact-ok
+= sinh downward binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok
+= sinh tonearest binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok
+= sinh towardzero binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok
+= sinh upward binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok
+= sinh downward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh tonearest intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh towardzero intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh upward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok
+= sinh downward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh tonearest m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh towardzero m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh upward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok
+= sinh downward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh tonearest binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh towardzero binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh upward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok
+= sinh downward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh tonearest ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh towardzero ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh upward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok
+= sinh downward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok
+= sinh tonearest binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok
+= sinh upward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh downward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh tonearest intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh upward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh downward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh tonearest m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh upward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh downward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok
+= sinh tonearest binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok
+= sinh towardzero binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok
+= sinh upward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok
+= sinh downward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok
+= sinh tonearest ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok
+= sinh towardzero ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok
+= sinh upward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok
+sinh -0x1.b7efa91915c95p-2
+= sinh downward binary32 -0x6.dfbeap-4 : -0x7.1661a8p-4 : inexact-ok
+= sinh tonearest binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok
+= sinh towardzero binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok
+= sinh upward binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok
+= sinh downward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok
+= sinh tonearest binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok
+= sinh towardzero binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok
+= sinh upward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok
+= sinh downward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok
+= sinh tonearest intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh towardzero intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh upward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh downward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok
+= sinh tonearest m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh towardzero m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh upward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok
+= sinh downward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok
+= sinh tonearest binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh towardzero binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh upward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok
+= sinh downward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok
+= sinh tonearest ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh towardzero ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh upward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok
+= sinh downward binary32 -0x6.dfbea8p-4 : -0x7.1661bp-4 : inexact-ok
+= sinh tonearest binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok
+= sinh towardzero binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok
+= sinh upward binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok
+= sinh downward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok
+= sinh tonearest binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok
+= sinh towardzero binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok
+= sinh upward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok
+= sinh downward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok
+= sinh tonearest intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh towardzero intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh upward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh downward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok
+= sinh tonearest m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh towardzero m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh upward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok
+= sinh downward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok
+= sinh tonearest binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok
+= sinh towardzero binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok
+= sinh upward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok
+= sinh downward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ecp-4 : inexact-ok
+= sinh tonearest ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh towardzero ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh upward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok
+= sinh downward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh tonearest binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok
+= sinh upward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok
+= sinh downward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh tonearest intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh upward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh downward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh tonearest m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok
+= sinh towardzero m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh upward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok
+= sinh downward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok
+= sinh tonearest binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok
+= sinh towardzero binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok
+= sinh upward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok
+= sinh downward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok
+= sinh tonearest ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok
+= sinh towardzero ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok
+= sinh upward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok
+sinh 0x1.92a5c27afbe82p+4
+= sinh downward binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok
+= sinh tonearest binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok
+= sinh towardzero binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok
+= sinh upward binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok
+= sinh downward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh tonearest binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh towardzero binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh upward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c858p+32 : inexact-ok
+= sinh downward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh tonearest intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh towardzero intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh upward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh downward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh tonearest m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh towardzero m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh upward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh downward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok
+= sinh tonearest binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok
+= sinh towardzero binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok
+= sinh upward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok
+= sinh downward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh tonearest ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh towardzero ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh upward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok
+= sinh downward binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok
+= sinh tonearest binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok
+= sinh towardzero binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok
+= sinh upward binary32 0x1.92a5c2p+4 : 0x9.e40f9p+32 : inexact-ok
+= sinh downward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok
+= sinh tonearest binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok
+= sinh towardzero binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok
+= sinh upward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok
+= sinh downward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh tonearest intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh towardzero intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh upward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh downward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh tonearest m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh towardzero m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh upward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh downward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh tonearest binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh towardzero binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh upward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok
+= sinh downward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh tonearest ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh towardzero ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh upward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok
+= sinh downward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh tonearest binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392ap+32 : inexact-ok
+= sinh downward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh tonearest intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok
+= sinh downward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh tonearest m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok
+= sinh downward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok
+= sinh tonearest binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok
+= sinh towardzero binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok
+= sinh upward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok
+= sinh downward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok
+= sinh tonearest ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok
+= sinh towardzero ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok
+= sinh upward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392980000000000024p+32 : inexact-ok
+sinh -0x1.92a5c27afbe82p+4
+= sinh downward binary32 -0x1.92a5c2p+4 : -0x9.e40f9p+32 : inexact-ok
+= sinh tonearest binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok
+= sinh towardzero binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok
+= sinh upward binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok
+= sinh downward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok
+= sinh tonearest binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok
+= sinh towardzero binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok
+= sinh upward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok
+= sinh downward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh tonearest intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh towardzero intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh upward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh downward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh tonearest m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok
+= sinh towardzero m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh upward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok
+= sinh downward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok
+= sinh tonearest binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh towardzero binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh upward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok
+= sinh downward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok
+= sinh tonearest ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh towardzero ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh upward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok
+= sinh downward binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok
+= sinh tonearest binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok
+= sinh towardzero binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok
+= sinh upward binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok
+= sinh downward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c858p+32 : inexact-ok
+= sinh tonearest binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh towardzero binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh upward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok
+= sinh downward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh tonearest intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh towardzero intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh upward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh downward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh tonearest m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok
+= sinh towardzero m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh upward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok
+= sinh downward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok
+= sinh tonearest binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok
+= sinh towardzero binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok
+= sinh upward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok
+= sinh downward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok
+= sinh tonearest ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh towardzero ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh upward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok
+= sinh downward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392ap+32 : inexact-ok
+= sinh tonearest binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh downward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok
+= sinh tonearest intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh downward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok
+= sinh tonearest m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh towardzero m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh upward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok
+= sinh downward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok
+= sinh tonearest binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok
+= sinh towardzero binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok
+= sinh upward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok
+= sinh downward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392980000000000024p+32 : inexact-ok
+= sinh tonearest ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok
+= sinh towardzero ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok
+= sinh upward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok
diff --git a/sysdeps/ieee754/dbl-64/e_sinh.c b/sysdeps/ieee754/dbl-64/e_sinh.c
index 1643f3f504..638e3d6a6d 100644
--- a/sysdeps/ieee754/dbl-64/e_sinh.c
+++ b/sysdeps/ieee754/dbl-64/e_sinh.c
@@ -213,7 +213,7 @@ __sinh (double x)
 		  ml = (ul + 8) & MANTISSA_MASK;
 	  th += tl;
 	  th *= 2;
-	  th *= asuint64 (sp);
+	  th *= sp;
 	  if (ml <= 16 || eh - el > 103)
 	    return as_sinh_database (x, th);
 	  return th;
diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.c b/sysdeps/ieee754/dbl-64/e_sinh_data.c
index ca61e311f1..d4fd41d934 100644
--- a/sysdeps/ieee754/dbl-64/e_sinh_data.c
+++ b/sysdeps/ieee754/dbl-64/e_sinh_data.c
@@ -35,12 +35,13 @@ const double __sinh_data_ch[][2] =
     { 0x1.ae64567f54482p-26, -0x1.defcf17a6ab79p-81 }
   };
 
-const double __sinh_data_db[49][3] =
+const double __sinh_data_db[51][3] =
   {
     { 0x1.364303e1ad8f6p-2, 0x1.3b07e0c779ddap-2, -0x1.bcp-106 },
     { 0x1.4169f234f23b9p-2, 0x1.46b7b3b358f99p-2, -0x1p-56 },
     { 0x1.616cc75d49226p-2, 0x1.687bd068c1c1ep-2, 0x1.ap-111 },
     { 0x1.ae3773250e7d2p-2, 0x1.bafc3479fc9ccp-2, -0x1p-105 },
+    { 0x1.b7efa91915c95p-2, 0x1.c59869f17b483p-2, -0x1p-104 },
     { 0x1.d68039861ab53p-2, 0x1.e73b46abb01e1p-2, -0x1.2p-109 },
     { 0x1.e90f16eb88c09p-2, 0x1.fbdd4a37760b7p-2, -0x1.f8p-108 },
     { 0x1.a3fc7e4dd47d1p-1, 0x1.d4b21ebf542fp-1, 0x1.ep-107 },
@@ -62,6 +63,7 @@ const double __sinh_data_db[49][3] =
     { 0x1.43a81752eabe7p+3, 0x1.81d364845ecfap+13, -0x1p-90 },
     { 0x1.16369cd53bb69p+4, 0x1.0fbc6c02b1c9p+24, -0x1.9p-81 },
     { 0x1.20e29ea8b51e2p+4, 0x1.08b8abba28abcp+25, 0x1.9bp-79 },
+    { 0x1.92a5c27afbe82p+4, 0x1.3c81f9a247253p+35, 0x1p-67 },
     { 0x1.a1e4f11b513d7p+4, 0x1.9a65b6c2e2185p+36, -0x1.bcp-70 },
     { 0x1.c089fcf166171p+4, 0x1.5c452e0e37569p+39, 0x1.4p-69 },
     { 0x1.e42a98b3a0be5p+4, 0x1.938768ca4f8aap+42, 0x1.6dp-62 },
diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.h b/sysdeps/ieee754/dbl-64/e_sinh_data.h
index 16f7e0da5a..c34848fd54 100644
--- a/sysdeps/ieee754/dbl-64/e_sinh_data.h
+++ b/sysdeps/ieee754/dbl-64/e_sinh_data.h
@@ -29,7 +29,7 @@ SOFTWARE.
 
 extern const double __sinh_data_ch[][2] attribute_hidden;
 #define CH __sinh_data_ch
-extern const double __sinh_data_db[49][3] attribute_hidden;
+extern const double __sinh_data_db[51][3] attribute_hidden;
 #define DB __sinh_data_db
 
 #endif

commit 0b58f5d80d24cf83cfde9d8381aafb11fef0e152
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Jul 30 08:55:54 2026 -0300

    math: Fix x86_64 tanh _FloatN aliases binding to the FMA variant [BZ 34465]
    
    The generic implementation emits libm_alias_double unconditionally, so
    tanhf32x and tanhf64 bind directly to __tanh_fma.
    
    Guard the alias with '#ifndef __tanh' and emit it from the dispatcher,
    as sin.  Also remove the stale __expm1 defines, unused since tanh moved
    to CORE-MATH.
    
    Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'.
    
    Reported-by: Michael Brunnbauer <brunni@netestate.de>
    
    (cherry picked from commit b01abba04a954cbd6b2834c0643a08685a915fe5)

diff --git a/NEWS b/NEWS
index fe2b1d7f79..43667c1963 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,7 @@ The following bugs are resolved with this release:
 
   [34441] math: math: sinh() returns wrong results for some inputs with
     |x| > 36.736801
+  [34465] math: math: x86_64 tanh ifunc selection wrong
 
 Version 2.44
 
diff --git a/sysdeps/ieee754/dbl-64/s_tanh.c b/sysdeps/ieee754/dbl-64/s_tanh.c
index 2029de8fa5..ef80b9edb6 100644
--- a/sysdeps/ieee754/dbl-64/s_tanh.c
+++ b/sysdeps/ieee754/dbl-64/s_tanh.c
@@ -283,4 +283,6 @@ __tanh (double x)
     return as_tanh_database (x, res);
   return res;
 }
+#ifndef __tanh
 libm_alias_double (__tanh, tanh)
+#endif
diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c
index 1b808b1227..1e6b33740a 100644
--- a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c
+++ b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c
@@ -1,10 +1,4 @@
 #define __tanh __tanh_fma
-#define __expm1 __expm1_fma
-
-/* NB: __expm1 may be expanded to __expm1_fma in the following
-   prototypes.  */
-extern long double __expm1l (long double);
-extern long double __expm1f128 (long double);
 
 #define SECTION __attribute__ ((section (".text.fma")))
 
diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh.c b/sysdeps/x86_64/fpu/multiarch/s_tanh.c
index ec8826f634..9048c977c1 100644
--- a/sysdeps/x86_64/fpu/multiarch/s_tanh.c
+++ b/sysdeps/x86_64/fpu/multiarch/s_tanh.c
@@ -25,10 +25,9 @@ extern double __redirect_tanh (double);
 # define SYMBOL_NAME tanh
 # include "ifunc-fma.h"
 
-libc_ifunc_redirected (__redirect_tanh, tanh, IFUNC_SELECTOR ());
+libc_ifunc_redirected (__redirect_tanh, __tanh, IFUNC_SELECTOR ());
+libm_alias_double (__tanh, tanh)
 
 # define __tanh __tanh_sse2
-# undef libm_alias_double
-# define libm_alias_double(a, b)
 #endif
 #include <sysdeps/ieee754/dbl-64/s_tanh.c>

commit 9bcb85688e58847191deb42bfc68d60802078df4
Author: Xi Ruoyao <xry111@xry111.site>
Date:   Wed Jul 22 19:26:10 2026 +0800

    io: fix ftw ABI on MIPS n64
    
    On MIPS n64 off_t is same as off64_t, but struct stat is not same as
    struct stat64 (very peculiar but see the "as tempting as it..." comment
    in linux/mips/kernel_stat.h).  As the ftw/ftw64 callback accepts a
    pointer to a function who accepts struct stat/stat64, for MIPS n64 we
    must use different implementations for ftw and ftw64.
    
    Thus for testing if ftw64 can be aliased to ftw, we should check
    XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T.
    
    This resolves the io/tst-ftw-lnk failure observed on MIPS n64.
    
    Link: https://sourceware.org/glibc/wiki/Testing/Tests/io/tst-ftw-lnk
    Signed-off-by: Xi Ruoyao <xry111@xry111.site>
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    
    (cherry picked from commit 6758def717175e679cb49b5051b6b5ec54ddfb2c)

diff --git a/io/ftw.c b/io/ftw.c
index ed0eeb3904..a9368a706e 100644
--- a/io/ftw.c
+++ b/io/ftw.c
@@ -18,7 +18,9 @@
 
 #include <sys/types.h>
 
-#ifndef __OFF_T_MATCHES_OFF64_T
+#include <kernel_stat.h>
+
+#if !XSTAT_IS_XSTAT64
 # include "ftw-common.c"
 
 versioned_symbol (libc, __new_nftw, nftw, GLIBC_2_3_3);
diff --git a/io/ftw64.c b/io/ftw64.c
index d3cd14c21a..fa7b05df22 100644
--- a/io/ftw64.c
+++ b/io/ftw64.c
@@ -31,6 +31,9 @@
 #define ftw __rename_ftw
 #define nftw __rename_nftw
 
+#include <sys/types.h>
+
+#include <kernel_stat.h>
 #include <shlib-compat.h>
 #include "ftw-common.c"
 
@@ -44,7 +47,7 @@ versioned_symbol (libc, __new_nftw64, nftw64, GLIBC_2_3_3);
 compat_symbol (libc, __old_nftw64, nftw64, GLIBC_2_1);
 #endif
 
-#ifdef __OFF_T_MATCHES_OFF64_T
+#if XSTAT_IS_XSTAT64
 weak_alias (__ftw64, ftw)
 versioned_symbol (libc, __new_nftw64, nftw, GLIBC_2_3_3);
 # if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_3_3)

commit 58da792d8a2d8f2fe711318836e853fcddfd7cd8
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Aug 4 14:25:48 2026 +0000

    hurd: Fix build after the ftw kernel_stat.h inclusion
    
    Commit 6758def7171 changed the generic ftw{64}.c to include
    kernel_stat.h, which is Linux specific.
    
    Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0,
    since struct stat and struct stat64 never share a layout on Hurd: on
    32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat,
    and on 64-bit ABIs the two structures still differ in size because
    _SPARE_SIZE in bits/stat.h reserves three more ints of spare space in
    struct stat than in struct stat64.
    
    This keeps the ftw/ftw64 symbols exactly as before the change, where
    the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because
    the Hurd bits/typesizes.h does not define it.
    
    Checked with a full build for i686-gnu and x86_64-gnu.
    
    (cherry picked from commit d6031665c3a59faf75cf6bc55e041611da21d0e6)

diff --git a/sysdeps/mach/hurd/kernel_stat.h b/sysdeps/mach/hurd/kernel_stat.h
new file mode 100644
index 0000000000..aa8c26b1d9
--- /dev/null
+++ b/sysdeps/mach/hurd/kernel_stat.h
@@ -0,0 +1,23 @@
+/* Internal definitions for stat functions.  Hurd version.
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+/* struct stat and struct stat64 never have the same layout: on 32-bit
+   ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and
+   on 64-bit ABIs the two structures still differ in the amount of
+   trailing spare space (see _SPARE_SIZE in bits/stat.h).  */
+#define XSTAT_IS_XSTAT64 0

commit fec2a9c6765b548f9d738e3a1c63a63ad7061d40
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Mar 21 14:03:00 2025 +0000

    linux: Inline syscall cancellation to keep wrapper frames observable (BZ 34338)
    
    The cancellable syscall wrappers end with a tail call to __syscall_cancel,
    the wrapper frame is then elided, so when the syscall executes the wrapper
    is no longer present on the stack.  Tools that unwind from CFI alone, such
    as valgrind, perf and sampling profilers, cannot observe it. On gdb, it
    only recovers it from DWARF call site information, which reduced-debuginfo
    libc builds usually omit.
    
    The behaviour is target dependent: for a shared (PIC) the tail call is
    emitted on aarch64, arc, loongarch and riscv.  It is not emitted on i386,
    x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed
    on the stack or fewer argument registers are available, nor on powerpc
    and mips, where the TOC/GOT pointer must be restored after the call.
    This is why the problem was originally reported as aarch64 specific while
    x86_64 was unaffected.
    
    Rather than only inhibiting the tail call [1] (which keeps the wrapper frame
    but still leaves the __syscall_cancel and __internal_syscall_cancel
    frames), move the cancellation logic back into the wrappers.  In the
    single-threaded case the syscall is now issued directly from the wrapper;
    only the multi-threaded path still calls the out-of-line __syscall_cancel_arch.
    
    This keeps the wrapper observable and removes the extra frames, mimicking
    how cancellation was handled before 89b53077d2a58f00e7debdfe58afabe953dac60d.
    
    The result is a small libc.so .text increase (size, first column):
    
      ABI            master      patched      diff    increase
      aarch64       1635880     1647424      11544      0.71%
      x86_64        1981081     1992257      11176      0.56%
      powerpc64le   2364336     2376964      12628      0.53%
      riscv64       1368386     1376704       8318      0.61%
      loongarch64   1741385     1755601      14216      0.82%
    
    The tst-backtrace5 was suppose to track this issue, but due wrong
    loop variable check it does not take this in account.  This patch also fixes
    it.
    
    Checked on aarch64-linux-gnu, x86_64-linux-gnu, i686-linux-gnu,
    arm-linux-gnueabihf, and powerpc64le-linux-gnu.
    
    [1] https://sourceware.org/pipermail/libc-alpha/2025-March/165395.html
    
    (cherry picked from commit 1b5ff009fa5bf01ad26e6cc330a1df5a0c84135e)

diff --git a/NEWS b/NEWS
index 43667c1963..28fbd9bcd8 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@ Version 2.44.1
 
 The following bugs are resolved with this release:
 
+  [34338] libc: Cancellable syscall wrappers are missing from backtraces
+    because they tail-call __syscall_cancel
   [34441] math: math: sinh() returns wrong results for some inputs with
     |x| > 36.736801
   [34465] math: math: x86_64 tanh ifunc selection wrong
diff --git a/debug/tst-backtrace5.c b/debug/tst-backtrace5.c
index 4c5784c060..6538da9ab5 100644
--- a/debug/tst-backtrace5.c
+++ b/debug/tst-backtrace5.c
@@ -36,10 +36,15 @@
    trampoline, read, 3 * fn, and do_test.  */
 #define NUM_FUNCTIONS 7
 
+/* Avoid the read wrapper frame truncation on targets that add extra frames
+   between it and handle_signal (the cancellable syscall wrappers
+   __syscall_cancel*, or the i686 __kernel_vsyscall entry).  */
+#define MAX_FUNCTIONS 64
+
 void
 handle_signal (int signum)
 {
-  void *addresses[NUM_FUNCTIONS];
+  void *addresses[MAX_FUNCTIONS];
   char **symbols;
   int n;
   int i;
@@ -70,23 +75,28 @@ handle_signal (int signum)
       return;
     }
 
-  /* Do not check name for signal trampoline or cancellable syscall
-     wrappers (__syscall_cancel*).  */
-  for (; i < n - 1; i++)
+  /* Skip the signal trampoline and any cancellable syscall wrapper frames
+     (__syscall_cancel*) and require the read syscall wrapper to be
+     present.  */
+  for (i = 1; i < n; i++)
     if (match (symbols[i], "read"))
       break;
-  if (i == n - 1)
+  if (i == n)
     {
       FAIL ();
       return;
     }
 
-  for (; i < n - 1; i++)
-    if (!match (symbols[i], "fn"))
-      {
-	FAIL ();
-	return;
-      }
+  /* The read wrapper must be followed by the three fn recursion frames.  */
+  for (int j = 0; j < 3; j++)
+    {
+      i++;
+      if (i == n || !match (symbols[i], "fn"))
+	{
+	  FAIL ();
+	  return;
+	}
+    }
   /* Symbol names are not available for static functions, so we do not
      check do_test.  */
 
diff --git a/elf/Makefile b/elf/Makefile
index 94c5b7e6ed..8b063e1bba 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1574,7 +1574,9 @@ $(objpfx)dl-allobjs.os: $(all-rtld-routines:%=$(objpfx)%.os)
 # when compiled for libc.
 rtld-stubbed-symbols = \
   __libc_assert_fail \
-  __syscall_cancel \
+  __libc_single_threaded_internal \
+  __syscall_cancel_arch \
+  __syscall_do_cancel \
   calloc \
   free \
   malloc \
diff --git a/nptl/cancellation.c b/nptl/cancellation.c
index 4368cb7231..63f09840ff 100644
--- a/nptl/cancellation.c
+++ b/nptl/cancellation.c
@@ -19,66 +19,6 @@
 #include <stdlib.h>
 #include "pthreadP.h"
 
-/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and
-   returns the syscall value or its negative error code.  */
-long int
-__internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2,
-			   __syscall_arg_t a3, __syscall_arg_t a4,
-			   __syscall_arg_t a5, __syscall_arg_t a6,
-			   __SYSCALL_CANCEL7_ARG_DEF
-			   __syscall_arg_t nr)
-{
-  long int result;
-  struct pthread *pd = THREAD_SELF;
-
-  /* If cancellation is not enabled, call the syscall directly and also
-     for thread terminatation to avoid call __syscall_do_cancel while
-     executing cleanup handlers.  */
-  int ch = atomic_load_relaxed (&pd->cancelhandling);
-  if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch))
-    {
-      result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6
-					  __SYSCALL_CANCEL7_ARCH_ARG7);
-      if (INTERNAL_SYSCALL_ERROR_P (result))
-	return -INTERNAL_SYSCALL_ERRNO (result);
-      return result;
-    }
-
-  /* Call the arch-specific entry points that contains the globals markers
-     to be checked by SIGCANCEL handler.  */
-  result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5,
-			          a6 __SYSCALL_CANCEL7_ARCH_ARG7);
-
-  /* If the cancellable syscall was interrupted by SIGCANCEL and it has no
-     side-effect, cancel the thread if cancellation is enabled.  */
-  ch = atomic_load_relaxed (&pd->cancelhandling);
-  /* The behaviour here assumes that EINTR is returned only if there are no
-     visible side effects.  POSIX Issue 7 has not yet provided any stronger
-     language for close, and in theory the close syscall could return EINTR
-     and leave the file descriptor open (conforming and leaks).  It expects
-     that no such kernel is used with glibc.  */
-  if (result == -EINTR && cancel_enabled_and_canceled (ch))
-    __syscall_do_cancel ();
-
-  return result;
-}
-
-/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the
-   syscall expected success value (usually 0) or, in case of failure, -1 and
-   sets errno to syscall return value.  */
-long int
-__syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2,
-		  __syscall_arg_t a3, __syscall_arg_t a4,
-		  __syscall_arg_t a5, __syscall_arg_t a6,
-		  __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr)
-{
-  long int r = __internal_syscall_cancel (a1, a2, a3, a4, a5, a6,
-					  __SYSCALL_CANCEL7_ARG nr);
-  return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r))
-	 ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r))
-	 : r;
-}
-
 /* Called by __syscall_cancel_arch or function above start the thread
    cancellation.  */
 _Noreturn void
diff --git a/nptl/futex-internal.c b/nptl/futex-internal.c
index fc6b11c8ad..07f1462abe 100644
--- a/nptl/futex-internal.c
+++ b/nptl/futex-internal.c
@@ -17,7 +17,7 @@
    <https://www.gnu.org/licenses/>.  */
 
 #include <errno.h>
-#include <sysdep.h>
+#include <sysdep-cancel.h>
 #include <time.h>
 #include <futex-internal.h>
 #include <kernel-features.h>
diff --git a/nptl/sem_waitcommon.c b/nptl/sem_waitcommon.c
index b0cbe5cebf..82c686f020 100644
--- a/nptl/sem_waitcommon.c
+++ b/nptl/sem_waitcommon.c
@@ -18,7 +18,7 @@
 
 #include <kernel-features.h>
 #include <errno.h>
-#include <sysdep.h>
+#include <sysdep-cancel.h>
 #include <futex-internal.h>
 #include <internaltypes.h>
 #include <semaphore.h>
diff --git a/sysdeps/unix/sysdep.h b/sysdeps/unix/sysdep.h
index a6ce5348ec..f0f271ec02 100644
--- a/sysdeps/unix/sysdep.h
+++ b/sysdeps/unix/sysdep.h
@@ -154,42 +154,31 @@
 # define __SYSCALL_CANCEL7_ARG7
 # define __SYSCALL_CANCEL7_ARCH_ARG7
 #endif
-long int __internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2,
-				    __syscall_arg_t a3, __syscall_arg_t a4,
-				    __syscall_arg_t a5, __syscall_arg_t a6,
-				    __SYSCALL_CANCEL7_ARG_DEF
-				    __syscall_arg_t nr) attribute_hidden;
-
-long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2,
-			   __syscall_arg_t arg3, __syscall_arg_t arg4,
-			   __syscall_arg_t arg5, __syscall_arg_t arg6,
-			   __SYSCALL_CANCEL7_ARG_DEF
-			   __syscall_arg_t nr) attribute_hidden;
 
 #define __SYSCALL_CANCEL0(name)						\
-  __syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL1(name, a1)					\
-  __syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0,				\
-		    __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0,				\
+		  __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL2(name, a1, a2) \
-  __syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0,			\
-		    __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0,			\
+		  __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL3(name, a1, a2, a3) \
-  __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0,	\
-		    __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0,	\
+		  __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL4(name, a1, a2, a3, a4) \
-  __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),			\
-		    __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),			\
+		  __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5) \
-  __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4),	\
-		    __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4),	\
+		  __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6) \
-  __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4),	\
-		    __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG	\
-		    __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4),	\
+		  __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG	\
+		  __NR_##name)
 #define __SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7)		\
-  __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4),	\
-		    __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name)
+  syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4),	\
+		  __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name)
 
 #define __SYSCALL_CANCEL_NARGS_X(a,b,c,d,e,f,g,h,n,...) n
 #define __SYSCALL_CANCEL_NARGS(...) \
@@ -206,33 +195,33 @@ long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2,
   __SYSCALL_CANCEL_DISP (__SYSCALL_CANCEL, __VA_ARGS__)
 
 #define __INTERNAL_SYSCALL_CANCEL0(name)				\
-  __internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG	\
+  internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG	\
 			     __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL1(name, a1)				\
-  __internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0,			\
-			     __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0,			\
+			   __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL2(name, a1, a2)			\
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0,	\
-			     __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0,	\
+			   __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL3(name, a1, a2, a3)			\
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0,	\
-			     0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0,	\
+			   0, 0, __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL4(name, a1, a2, a3, a4)		\
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
-			     __SSC(a4), 0, 0,				\
-			     __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
+			   __SSC(a4), 0, 0,				\
+			   __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5)		\
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
-			     __SSC(a4), __SSC (a5), 0,			\
-			     __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
+			   __SSC(a4), __SSC (a5), 0,			\
+			   __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6)	\
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
-			     __SSC (a4), __SSC (a5), __SSC (a6),	\
-			     __SYSCALL_CANCEL7_ARG __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),	\
+			   __SSC (a4), __SSC (a5), __SSC (a6),	\
+			   __SYSCALL_CANCEL7_ARG __NR_##name)
 #define __INTERNAL_SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7) \
-  __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),     \
-			     __SSC (a4), __SSC (a5), __SSC (a6),     \
-			     __SSC (a7), __NR_##name)
+  internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3),     \
+			   __SSC (a4), __SSC (a5), __SSC (a6),     \
+			   __SSC (a7), __NR_##name)
 
 /* Issue a cancellable syscall defined by syscall number NAME plus any other
    argument required.  If an error occurs its value is returned as an negative
diff --git a/sysdeps/unix/sysv/linux/epoll_pwait2.c b/sysdeps/unix/sysv/linux/epoll_pwait2.c
index 4da03e3e69..76ec1f8a71 100644
--- a/sysdeps/unix/sysv/linux/epoll_pwait2.c
+++ b/sysdeps/unix/sysv/linux/epoll_pwait2.c
@@ -17,7 +17,7 @@
    <https://www.gnu.org/licenses/>.  */
 
 #include <sys/epoll.h>
-#include <sysdep.h>
+#include <sysdep-cancel.h>
 
 int
 __epoll_pwait2_time64 (int fd, struct epoll_event *ev, int maxev,
diff --git a/sysdeps/unix/sysv/linux/recvmmsg.c b/sysdeps/unix/sysv/linux/recvmmsg.c
index 6fbe4b80aa..6a89f914c2 100644
--- a/sysdeps/unix/sysv/linux/recvmmsg.c
+++ b/sysdeps/unix/sysv/linux/recvmmsg.c
@@ -16,7 +16,7 @@
    <https://www.gnu.org/licenses/>.  */
 
 #include <sys/socket.h>
-#include <sysdep.h>
+#include <sysdep-cancel.h>
 #include <socketcall.h>
 
 static int
diff --git a/sysdeps/unix/sysv/linux/sigtimedwait.c b/sysdeps/unix/sysv/linux/sigtimedwait.c
index a4fa8e9e8e..c2c5e2c0f2 100644
--- a/sysdeps/unix/sysv/linux/sigtimedwait.c
+++ b/sysdeps/unix/sysv/linux/sigtimedwait.c
@@ -16,7 +16,7 @@
    <https://www.gnu.org/licenses/>.  */
 
 #include <signal.h>
-#include <sysdep.h>
+#include <sysdep-cancel.h>
 
 int
 __sigtimedwait64 (const sigset_t *set, siginfo_t *info,
diff --git a/sysdeps/unix/sysv/linux/sysdep-cancel.h b/sysdeps/unix/sysv/linux/sysdep-cancel.h
index 7fd8258ba5..4b7278915a 100644
--- a/sysdeps/unix/sysv/linux/sysdep-cancel.h
+++ b/sysdeps/unix/sysv/linux/sysdep-cancel.h
@@ -21,5 +21,66 @@
 #define _SYSDEP_CANCEL_H
 
 #include <sysdep.h>
+#include "pthreadP.h"
+
+/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and
+   returns the syscall value or its negative error code.  */
+static __always_inline long int
+internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2,
+			 __syscall_arg_t a3, __syscall_arg_t a4,
+			 __syscall_arg_t a5, __syscall_arg_t a6,
+			 __SYSCALL_CANCEL7_ARG_DEF
+			 __syscall_arg_t nr)
+{
+  long int result;
+  struct pthread *pd = THREAD_SELF;
+
+  /* If cancellation is not enabled, call the syscall directly and also
+     for thread terminatation to avoid call __syscall_do_cancel while
+     executing cleanup handlers.  */
+  int ch = atomic_load_relaxed (&pd->cancelhandling);
+  if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch))
+    {
+      result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6
+					  __SYSCALL_CANCEL7_ARCH_ARG7);
+      if (INTERNAL_SYSCALL_ERROR_P (result))
+	return -INTERNAL_SYSCALL_ERRNO (result);
+      return result;
+    }
+
+  /* Call the arch-specific entry points that contains the globals markers
+     to be checked by SIGCANCEL handler.  */
+  result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5,
+			          a6 __SYSCALL_CANCEL7_ARCH_ARG7);
+
+  /* If the cancellable syscall was interrupted by SIGCANCEL and it has no
+     side-effect, cancel the thread if cancellation is enabled.  */
+  ch = atomic_load_relaxed (&pd->cancelhandling);
+  /* The behaviour here assumes that EINTR is returned only if there are no
+     visible side effects.  POSIX Issue 7 has not yet provided any stronger
+     language for close, and in theory the close syscall could return EINTR
+     and leave the file descriptor open (conforming and leaks).  It expects
+     that no such kernel is used with glibc.  */
+  if (result == -EINTR && cancel_enabled_and_canceled (ch))
+    __syscall_do_cancel ();
+
+  return result;
+}
+
+/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the
+   syscall expected success value (usually 0) or, in case of failure, -1 and
+   sets errno to syscall return value.  */
+static __always_inline long int
+syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2,
+		__syscall_arg_t a3, __syscall_arg_t a4,
+		__syscall_arg_t a5, __syscall_arg_t a6,
+		__SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr)
+{
+  long int r = internal_syscall_cancel (a1, a2, a3, a4, a5, a6,
+					__SYSCALL_CANCEL7_ARG nr);
+  return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r))
+	 ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r))
+	 : r;
+}
 
 #endif

commit 5d1e923ed79185668ac62d19fc37e7e23a3642b6
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Aug 6 14:07:55 2026 -0300

    Fix gen-as-const-headers races with the parallel subdir recursion (BZ 34438)
    
    The parallel subdirectory recursion (commit 7cac99621e96) only orders
    csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges
    the Depend files request.  A header generated from gen-as-const-headers
    is only ordered before the compilations of the subdirectory that
    adds the .sym (through before-compile), so a header consumed by a
    different subdirectory may not exist yet when its consumer is
    compiled.
    
    That is the case for <sigaltstack-offsets.h>: it is generated when
    building misc, while its only consumer, ____longjmp_chk.S (x86_64 and
    sh), is built in debug.  The serial recursion always ran misc before
    debug in the sorted order, hiding the missing dependency.
    
    Move the generate the header to 'debug' instead.
    
    The same class of problem exists on Hurd: jmp_buf-ssp.h that is used
    by ____longjmp_chk.S in debug, and signal-defines.h that is sued
    by debug and setjmp.
    
    Deterministically reproduced with 'make debug/subdir_lib' from a clean
    build tree (which orders only csu before debug), and verified with
    builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit 60c9ed0e6b9cce07e85ee56fc39b9afe36919e45)

diff --git a/Makerules b/Makerules
index 6bef57ece9..cef30974f1 100644
--- a/Makerules
+++ b/Makerules
@@ -259,7 +259,17 @@ endif  # gen-py-const-headers
 ifdef gen-as-const-headers
 # Generating headers for assembly constants.
 # We need this defined early to get into before-compile before
-# it's used in sysd-rules, below.
+# it's used in sysd-rules, below.  The gen-as-const-headers is evaluated
+# per subdirectory, so the before-compile dependency below only orders
+# the generated header before the compiles of the subdirectory whose
+# Makefile adds the .sym directive.
+# The parallel subdirectory recursion does not order sibling subdirectories,
+# so a .sym must be added in the subdirectory that compiles its consumers,
+# or in csu (which runs before the parallel) when it has consumers in
+# several subdirectories.
+# It must not add the same .sym in several subdirectories though: their
+# concurrent sub-makes would race generating the header through the fixed
+# temporary files below.
 # Define GEN_AS_CONST_HEADERS to avoid circular dependency [BZ #22792].
 # NB: <tcb-offsets.h> is generated from tcb-offsets.sym to define
 # offsets and sizes of types in <tls.h> and maybe <pthread.h> which
diff --git a/NEWS b/NEWS
index 28fbd9bcd8..ee292ff6c9 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ The following bugs are resolved with this release:
 
   [34338] libc: Cancellable syscall wrappers are missing from backtraces
     because they tail-call __syscall_cancel
+  [34438] build: non reproducible build failure: sigaltstack-offsets.h:
+    No such file or directory
   [34441] math: math: sinh() returns wrong results for some inputs with
     |x| > 36.736801
   [34465] math: math: x86_64 tanh ifunc selection wrong
diff --git a/sysdeps/mach/hurd/x86/Makefile b/sysdeps/mach/hurd/x86/Makefile
index 97e3287c87..1d94f3a1c1 100644
--- a/sysdeps/mach/hurd/x86/Makefile
+++ b/sysdeps/mach/hurd/x86/Makefile
@@ -3,11 +3,7 @@ sysdep_routines += ioperm
 sysdep_headers += sys/io.h
 endif
 
-ifeq ($(subdir),debug)
-gen-as-const-headers += signal-defines.sym
-endif
-
-ifeq ($(subdir),setjmp)
+ifeq ($(subdir),csu)
 gen-as-const-headers += signal-defines.sym
 endif
 
diff --git a/sysdeps/unix/sysv/linux/sh/Makefile b/sysdeps/unix/sysv/linux/sh/Makefile
index dd3b382ac1..8c4cb73824 100644
--- a/sysdeps/unix/sysv/linux/sh/Makefile
+++ b/sysdeps/unix/sysv/linux/sh/Makefile
@@ -6,7 +6,9 @@ ifeq ($(subdir),stdlib)
 gen-as-const-headers += ucontext_i.sym
 endif
 
-ifeq ($(subdir),misc)
+# <sigaltstack-offsets.h> is only used by ____longjmp_chk.S, which is
+# built in the debug subdirectory.
+ifeq ($(subdir),debug)
 gen-as-const-headers += sigaltstack-offsets.sym
 endif
 
diff --git a/sysdeps/unix/sysv/linux/x86_64/Makefile b/sysdeps/unix/sysv/linux/x86_64/Makefile
index 6938382801..528fd951b2 100644
--- a/sysdeps/unix/sysv/linux/x86_64/Makefile
+++ b/sysdeps/unix/sysv/linux/x86_64/Makefile
@@ -10,7 +10,9 @@ ifeq ($(subdir),csu)
 gen-as-const-headers += ucontext_i.sym
 endif
 
-ifeq ($(subdir),misc)
+# <sigaltstack-offsets.h> is only used by ____longjmp_chk.S, which is
+# built in the debug subdirectory.
+ifeq ($(subdir),debug)
 gen-as-const-headers += sigaltstack-offsets.sym
 endif
 
diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile
index 232e388d32..b4434deb0c 100644
--- a/sysdeps/x86/Makefile
+++ b/sysdeps/x86/Makefile
@@ -1,5 +1,12 @@
 ifeq ($(subdir),csu)
-gen-as-const-headers += cpu-features-offsets.sym features-offsets.sym
+# <jmp_buf-ssp.h> is used by the setjmp/longjmp implementations in the
+# setjmp subdirectory and also by ____longjmp_chk.S in the debug
+# subdirectory.
+gen-as-const-headers += \
+  cpu-features-offsets.sym \
+  features-offsets.sym \
+  jmp_buf-ssp.sym \
+  # gen-as-const-headers
 endif
 
 ifeq ($(subdir),elf)
@@ -171,7 +178,6 @@ tests += \
 endif # $(subdir) == math
 
 ifeq ($(subdir),setjmp)
-gen-as-const-headers += jmp_buf-ssp.sym
 sysdep_routines += __longjmp_cancel
 endif
 

commit 45b8a13c48da92bc5dd6fe102011391dd6847862
Author: Rudi Heitbaum <rudi@heitbaum.com>
Date:   Thu Aug 6 14:07:56 2026 -0300

    Makerules: Only install the ABI lib-names header from the top level (BZ 34439)
    
    The $(inst_includedir)/%.h install rules exist only where $(headers) is
    non-empty, so in a subdir without headers (e.g. csu) the prerequisite
    added on install-others-nosubdir has no rule.
    
    It only worked because .NOTPARALLEL made the top level install the header
    first, which the parallel subdir recursion no longer guarantees.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit 82c0a96b8e63005a49ba52ddb21993811030613f)

diff --git a/Makerules b/Makerules
index cef30974f1..dfe66b7fa6 100644
--- a/Makerules
+++ b/Makerules
@@ -312,7 +312,12 @@ lib-names-h-abi = gnu/lib-names-$(default-abi).h
 lib-names-stmp-abi = gnu/lib-names-$(default-abi).stmp
 before-compile += $(common-objpfx)$(lib-names-h-abi)
 common-generated += gnu/lib-names.h
+# The $(inst_includedir)/%.h install rules are defined only where $(headers)
+# is non-empty, and with parallel subdir recursion a subdir without headers
+# (e.g. csu) may run before the top level has installed the header.
+ifndef subdir
 install-others-nosubdir: $(inst_includedir)/$(lib-names-h-abi)
+endif
 $(common-objpfx)gnu/lib-names.h:
 	$(make-target-directory)
 	{ \
diff --git a/NEWS b/NEWS
index ee292ff6c9..d0ef2d3e9a 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,8 @@ The following bugs are resolved with this release:
     because they tail-call __syscall_cancel
   [34438] build: non reproducible build failure: sigaltstack-offsets.h:
     No such file or directory
+  [34439] build: parallel make install fails on multi-ABI targets: no
+    rule to make $(inst_includedir)/gnu/lib-names-$(abi).h in csu
   [34441] math: math: sinh() returns wrong results for some inputs with
     |x| > 36.736801
   [34465] math: math: x86_64 tanh ifunc selection wrong

commit f7beb24f3ad5dbf8e84a5b75d5b2428a262e9ab9
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Aug 6 14:07:57 2026 -0300

    Makefile: Only print the test summary in the second pass of 'make check'
    
    The build-only first pass of the two-pass 'make check' still runs the
    static checks (abi, conformtest, installed headers, etc.), and the
    top-level tests recipe merged and summarized their results.
    
    An unexpected FAIL there (e.g. check-abi) aborted 'check' before the
    second pass ran any built test, and even a clean run printed a misleading
    partial summary.
    
    Pass tests-summary=no in the first pass to skip the merge and summary;
    the .test-result files persist, so the second pass folds those results
    into the one complete summary at the end, restoring the single-pass
    reporting behavior.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit 96a9a09d7d5527462a823c247569e65feeca8ddb)

diff --git a/Makefile b/Makefile
index a6aabca691..b9fac6f47c 100644
--- a/Makefile
+++ b/Makefile
@@ -869,7 +869,11 @@ endif
 	touch $(objpfx)testroot.pristine/install.stamp
 
 tests-special-notdir = $(patsubst $(objpfx)%, %, $(tests-special))
+# The build-only first pass of the two-pass 'make check' (see Makerules)
+# passes tests-summary=no: the merge and summary are left to the second
+# pass, which folds in this pass's $(tests-special) results.
 tests: $(tests-special)
+ifneq ($(tests-summary),no)
 	$(..)scripts/merge-test-results.sh -s $(objpfx) "" \
 	  $(sort $(tests-special-notdir:.out=)) \
 	  > $(objpfx)subdir-tests.sum
@@ -877,11 +881,14 @@ tests: $(tests-special)
 	  $(sort $(subdirs) .) \
 	  > $(objpfx)tests.sum
 	$(call summarize-tests,tests.sum)
+endif
 xtests:
+ifneq ($(tests-summary),no)
 	$(..)scripts/merge-test-results.sh -t $(objpfx) subdir-xtests.sum \
 	  $(sort $(subdirs)) \
 	  > $(objpfx)xtests.sum
 	$(call summarize-tests,xtests.sum, for extra tests)
+endif
 
 # The realclean target is just like distclean for the parent, but we want
 # the subdirs to know the difference in case they care.
diff --git a/Makerules b/Makerules
index dfe66b7fa6..5f65f3ab9e 100644
--- a/Makerules
+++ b/Makerules
@@ -1211,6 +1211,13 @@ ALL_BUILD_CFLAGS = $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) -D_GNU_SOURCE \
 # therefore builds the test programs (run-built-tests=no, recursion fully
 # parallel) and then runs them (run-built-tests=yes).  'make tests' and a
 # subdirectory's own 'check' stay single-pass.
+# The first pass still runs the static checks ($(tests-special): abi,
+# conformtest, installed headers, ...), so tests-summary=no makes it skip
+# the results merge and summary: an unexpected FAIL there would otherwise
+# abort 'check' before the second pass runs any built test, and even a
+# clean run would print a misleading partial summary.  The .test-result
+# files persist, so the second pass folds those results into the one
+# complete summary at the end.
 check-twopass :=
 ifndef subdir
 ifeq (yes,$(run-built-tests))
@@ -1219,10 +1226,10 @@ endif
 endif
 ifeq (yes,$(check-twopass))
 check:
-	$(MAKE) run-built-tests=no  tests
+	$(MAKE) run-built-tests=no  tests-summary=no tests
 	$(MAKE) run-built-tests=yes tests
 xcheck:
-	$(MAKE) run-built-tests=no  xtests
+	$(MAKE) run-built-tests=no  tests-summary=no xtests
 	$(MAKE) run-built-tests=yes xtests
 else
 check: tests

commit fc3641194619c7c327ef398c88c07b3069878ed3
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Aug 6 14:07:58 2026 -0300

    Makerules: Make the .dt to .d conversion safe against concurrent sub-makes
    
    The %.d: %.dt rule seds its input into a fixed temporary name, renames
    it into place and removes the input.  Two makes converting the same
    file trip over each other:
    
      mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory
      sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory
    
    That happens because the elf rtld-Rules recursion runs a sub-make over
    every $(rtld-subdirs) directory, which converts that directory's .dt
    files, and the parallel subdirectory recursion (commit 7cac99621e96)
    runs it concurrently with those subdirectories' own sub-makes.
    
    Add the PID of the shell to the temporary name and claim the input with
    a rename: only the run that wins converts and installs the target.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit ba8c8801be7674cc12406914184516a811ac22a8)

diff --git a/Makerules b/Makerules
index 5f65f3ab9e..be51154bae 100644
--- a/Makerules
+++ b/Makerules
@@ -758,10 +758,20 @@ all-dt-files := $(foreach o,$(object-suffixes-for-libc),$(+depfiles:.d=$o.dt))
 	     $(wildcard $(all-dt-files:.dt=.d))
 
 # This is a funny rule in that it removes its input file.
+#
+# More than one make can convert the .dt files of a single object
+# directory: the elf rtld-Rules recursion runs a sub-make over every
+# $(rtld-subdirs) directory, concurrently with that directory's own
+# sub-make under the parallel subdir recursion.  Add the PID of the
+# shell to the temporary name and claim the input with a rename: only
+# the run that wins converts and installs the target.
 %.d: %.dt
-	@sed $(sed-remove-objpfx) $< > $(@:.d=.T) && \
-	 mv -f $(@:.d=.T) $@ && \
-	 rm -f $<
+	@dt=$(@:.d=.T)$$$$; \
+	 if mv -f $< $$dt 2>/dev/null; then \
+	   sed $(sed-remove-objpfx) $$dt > $$dt.new && \
+	   mv -f $$dt.new $@ && \
+	   rm -f $$dt; \
+	 fi
 
 # Avoid the .h.d files for any .sym files whose .h files don't exist yet.
 # They will be generated when they're needed, and trying too early won't work.
@@ -1433,7 +1443,7 @@ endef
 # Also remove the dependencies and generated source files.
 common-clean: common-mostlyclean
 	-rm -f $(addprefix $(objpfx),$(generated))
-	-rm -f $(objpfx)*.d $(objpfx)*.dt
+	-rm -f $(objpfx)*.d $(objpfx)*.dt $(objpfx)*.T[0-9]*
 	-rm -fr $(addprefix $(objpfx),$(generated-dirs))
 	-rm -f $(addprefix $(common-objpfx),$(common-generated))
 	-rm -f $(gen-as-const-headers:%.sym=$(common-objpfx)%.h)

commit f34027b27fefbc94aab04bff613ba5c24fb909b1
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Aug 6 14:07:59 2026 -0300

    Makefile: Order the top-level stamp files before the subdirectory fan-out
    
    The archive rules in Makerules list every stamp file as a prerequisite,
    including the top level's own, and the elf sub-make evaluates them to
    build libc_pic.a for the librtld.map link.  A sub-make can only create
    the stamp files of its own directory, so when the top-level ones do not
    exist yet it fails with:
    
      make[2]: *** No rule to make target '.../stamp.os', needed by
      '.../libc_pic.a'.  Stop.
    
    The serial recursion created them before the subdirectories through the
    prerequisite order of subdir_lib; the parallel recursion (commit
    7cac99621e96) does not.  Add them as prerequisites of the object-building
    per-subdirectory targets.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit 25c42d04c45fc5fdb1481a7f968782791b21fd3e)

diff --git a/Makefile b/Makefile
index b9fac6f47c..d559c42873 100644
--- a/Makefile
+++ b/Makefile
@@ -575,6 +575,14 @@ $(foreach t,$(+elf_last_subdir_targets),$(eval \
   elf/$(t): $(addsuffix /$(t),$(filter-out elf,$(subdirs)))))
 endif
 
+# The archive rules in Makerules list every stamp file as a
+# prerequisite of libc_pic.a, which the elf sub-make evaluates for the
+# librtld.map link, but a sub-make can only create its own directory's
+# stamps.  Create the top-level ones before the fan-out.
+$(foreach t,$(+elf_last_subdir_targets),$(eval \
+  $(addsuffix /$(t),$(subdirs)): \
+    $(foreach o,$(object-suffixes-for-libc),$(common-objpfx)stamp$(o))))
+
 # Pass barriers: a subdirectory 'others' build links programs against
 # the libraries, so the 'lib' pass (including the top-level libc.so
 # link) must have completed.

commit 10e3ce8a57e134c13dd28772de68542b0e3d4e86
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Aug 6 14:08:00 2026 -0300

    arm: Order the rtld link after libgcc-stubs.a
    
    The librtld.map and librtld.os link recipes use $(gnulib), which on arm
    contains libgcc-stubs.a through gnulib-arch.  But the archive is only a
    prerequisite of lib-noranlib so the rtld link can run before the archive
    exists:
    
      ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory
    
    The race seems to predates the parallel subdirectory recursion, which
    only made it observable.
    
    Add the order-only dependency in sysdeps/arm/Makefile rather than in
    elf/Makefile.  Theprerequisite lists expand when the rule is parsed,
    and gnulib-arch is only defined once Makerules includes the sysdeps
    makefiles.
    
    Verified with a build for arm-linux-gnueabihf.
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit a33ceb6e96dc8de8d36de1b1f3ec06ceb524d012)

diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile
index 0bb1b6e05b..9042315492 100644
--- a/sysdeps/arm/Makefile
+++ b/sysdeps/arm/Makefile
@@ -10,6 +10,11 @@ shared-only-routines += aeabi_unwind_cpp_pr1
 $(objpfx)libgcc-stubs.a: $(objpfx)aeabi_unwind_cpp_pr1.os
 	$(build-extra-lib)
 
+# The rtld link recipes in elf/Makefile use $(gnulib), which here
+# includes libgcc-stubs.a, but they cannot name it as a prerequisite:
+# gnulib-arch is only defined once this file is included from Makerules.
+$(objpfx)librtld.map $(objpfx)librtld.os: | $(objpfx)libgcc-stubs.a
+
 lib-noranlib: $(objpfx)libgcc-stubs.a
 
 ifeq ($(build-shared),yes)

commit 26b9cc42a051f78233fcecd2a3b83f98ec9862b9
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Jul 28 11:27:33 2026 -0300

    benchtests: Create objdir in the bench-%.c generation rule
    
    The $(objpfx)bench-%.c rule writes its output into $(objpfx) without
    ensuring that directory exists.  Serial builds happened to satisfy
    that ordering, with parallel builds the generation recipe can
    run before the directory is created, failing with:
    
      cannot create .../benchtests/bench-xxx.c-tmp: Directory nonexistent
    
    Add the standard $(make-target-directory).
    
    Reviewed-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 26f0f2aa7d6ea63f85b5186349c41de2c91b4dd7)

diff --git a/benchtests/Makefile b/benchtests/Makefile
index f407e492cb..16cc951d19 100644
--- a/benchtests/Makefile
+++ b/benchtests/Makefile
@@ -622,6 +622,7 @@ $(bench-link-targets): %: %.o $(objpfx)json-lib.o \
 $(bench-link-targets): LDFLAGS += $(link-bench-bind-now)
 
 $(objpfx)bench-%.c: %-inputs $(bench-deps)
+	$(make-target-directory)
 	{ if [ -n "$($*-INCLUDE)" ]; then \
 	  cat $($*-INCLUDE); \
 	fi; \

commit 4662c4675d7f3ba87637c61730f06071f305c5cb
Author: Xi Ruoyao <xry111@xry111.site>
Date:   Sun Jul 26 00:11:44 2026 +0800

    elf: test: handle different rootsbindir in tst-ldconfig-cache
    
    When compiling a glibc for a merged-/usr distro people may set
    rootsbindir=/usr/sbin.  But tst-ldconfig-cache has hard-coded
    /sbin/ldconfig path and so it fails with a different rootsbindir.
    
    Fix it by using support_install_rootsbindir like run_ldconfig in
    test-container.c.
    
    Signed-off-by: Xi Ruoyao <xry111@xry111.site>
    Reviewed-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 02ea17b5add83a205d8b204dce28f38fe0498ea3)

diff --git a/elf/tst-ldconfig-cache.c b/elf/tst-ldconfig-cache.c
index 9f71418b3a..f4820a1822 100644
--- a/elf/tst-ldconfig-cache.c
+++ b/elf/tst-ldconfig-cache.c
@@ -85,7 +85,10 @@ corrupt (void)
 static void
 ldconfig (void)
 {
-  xsystem ("/sbin/ldconfig -X");
+  char *cmd = xasprintf("%s/ldconfig -X", support_install_rootsbindir);
+  xsystem (cmd);
+
+  free(cmd);
 }
 
 /* Change ld.so.conf to refer to the new directory, and generate a new

commit 9e1b1ef77c7b1cc58f625500e9ea74fb3cafdf12
Author: Matt Turner <mattst88@gmail.com>
Date:   Sun Jul 26 00:27:37 2026 -0400

    ldbl-opt: Fix -mlong-double-128 configure test for Clang
    
    The check for -mlong-double-128 support wrapped its test code in
    AC_LANG_PROGRAM, which places the body inside main().  The body defines
    a function, so it became a nested function definition -- a GCC extension
    that Clang does not implement, making the test fail (and thus the whole
    build error out) with Clang even though it supports -mlong-double-128.
    
    Use AC_LANG_SOURCE so the function is defined at file scope, matching the
    pattern already used by the powerpc64le compiler checks, and regenerate
    configure.
    
    Reviewed-by: Sam James <sam@gentoo.org>
    (cherry picked from commit e7a14f03b8d5e34e8ac46db6c377da5c66a3ec2a)

diff --git a/sysdeps/ieee754/ldbl-opt/configure b/sysdeps/ieee754/ldbl-opt/configure
old mode 100644
new mode 100755
index bc6552da0b..7769cc9781
--- a/sysdeps/ieee754/ldbl-opt/configure
+++ b/sysdeps/ieee754/ldbl-opt/configure
@@ -13,17 +13,10 @@ CFLAGS="$CFLAGS -mlong-double-128"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-int
-main (void)
-{
-
 #ifndef __LONG_DOUBLE_128__
 # error "compiler did not predefine __LONG_DOUBLE_128__ as expected"
 #endif
 long double foobar (long double x) { return x; }
-  ;
-  return 0;
-}
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"
 then :
diff --git a/sysdeps/ieee754/ldbl-opt/configure.ac b/sysdeps/ieee754/ldbl-opt/configure.ac
index 70e3b32dc6..1c500ad581 100644
--- a/sysdeps/ieee754/ldbl-opt/configure.ac
+++ b/sysdeps/ieee754/ldbl-opt/configure.ac
@@ -6,7 +6,7 @@ AC_CACHE_CHECK(whether $CC $CFLAGS supports -mlong-double-128,
 	       libc_cv_mlong_double_128, [dnl
 save_CFLAGS="$CFLAGS"
 CFLAGS="$CFLAGS -mlong-double-128"
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
 #ifndef __LONG_DOUBLE_128__
 # error "compiler did not predefine __LONG_DOUBLE_128__ as expected"
 #endif

commit eacd9cced93498e671c7e7f758aaf52593847e01
Author: Matt Turner <mattst88@gmail.com>
Date:   Sun Jul 26 14:43:11 2026 -0400

    powerpc: Fix -mlong-double-128 IBM format configure test for Clang
    
    The check for -mlong-double-128 IBM extended format support wrapped its
    test code in AC_LANG_PROGRAM, which places the body inside main().  The
    body defines a function, so it became a nested function definition -- a
    GCC extension that Clang does not implement, making the test fail with
    Clang.
    
    Use AC_LANG_SOURCE so the function is defined at file scope, and
    regenerate configure.
    
    Reviewed-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 559d0f77f3ee1000cf8a2d0baba7a59a1ec45f50)

diff --git a/sysdeps/unix/sysv/linux/powerpc/configure b/sysdeps/unix/sysv/linux/powerpc/configure
index ef2055db92..eb8578404f 100644
--- a/sysdeps/unix/sysv/linux/powerpc/configure
+++ b/sysdeps/unix/sysv/linux/powerpc/configure
@@ -12,18 +12,12 @@ else case e in #(
 CFLAGS="$CFLAGS -mlong-double-128"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <float.h>
-int
-main (void)
-{
 
+#include <float.h>
 #if LDBL_MANT_DIG != 106
 # error "compiler doesn't implement IBM extended format of long double"
 #endif
 long double foobar (long double x) { return x; }
-  ;
-  return 0;
-}
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"
 then :
diff --git a/sysdeps/unix/sysv/linux/powerpc/configure.ac b/sysdeps/unix/sysv/linux/powerpc/configure.ac
index 42347a66fc..ca0f82da08 100644
--- a/sysdeps/unix/sysv/linux/powerpc/configure.ac
+++ b/sysdeps/unix/sysv/linux/powerpc/configure.ac
@@ -6,7 +6,8 @@ AC_CACHE_CHECK(whether $CC $CFLAGS -mlong-double-128 uses IBM extended format,
 	       libc_cv_mlong_double_128ibm, [dnl
 save_CFLAGS="$CFLAGS"
 CFLAGS="$CFLAGS -mlong-double-128"
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <float.h>]], [[
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+#include <float.h>
 #if LDBL_MANT_DIG != 106
 # error "compiler doesn't implement IBM extended format of long double"
 #endif

commit 89da37bb6e4a631f375b5fe48783e5c023441b0c
Author: Matt Turner <mattst88@gmail.com>
Date:   Tue Aug 4 10:17:20 2026 -0400

    stdio-common: run AWK in the C locale in the printf format tests
    
    The program under test runs in the C locale, through the test program
    prefix, but AWK inherits whatever locale the build was started in.  They
    agree today only because the locale in use shares its decimal point with
    the C locale.
    
    It is also faster.  gawk takes a single byte path in its regular
    expression engine when MB_CUR_MAX is 1, and the script matches several
    expressions against every line.  For the %f conversion for double, the
    largest of these tests, as the median of five runs:
    
      x86_64, gawk 5.4.1    1.482s -> 1.248s
      x86_64, gawk 5.3.2    0.911s -> 0.703s
      alpha,  gawk 5.4.60    30.9s ->  26.6s
    
    Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at
    1.248s against 0.703s for the same input in the C locale, so these tests
    have become more expensive than they used to be.
    
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit 866a70167b85903a02d4ccacb91afb8922702c14)

diff --git a/stdio-common/tst-printf-format-c.sh b/stdio-common/tst-printf-format-c.sh
index 825c50ec42..73d28c5607 100644
--- a/stdio-common/tst-printf-format-c.sh
+++ b/stdio-common/tst-printf-format-c.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 echo Verifying c
 (set -o pipefail
diff --git a/stdio-common/tst-printf-format-char.sh b/stdio-common/tst-printf-format-char.sh
index 7867bdd62f..aa4d211126 100644
--- a/stdio-common/tst-printf-format-char.sh
+++ b/stdio-common/tst-printf-format-char.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=0
 
diff --git a/stdio-common/tst-printf-format-double.sh b/stdio-common/tst-printf-format-double.sh
index 8157092dc4..051e4716c5 100644
--- a/stdio-common/tst-printf-format-double.sh
+++ b/stdio-common/tst-printf-format-double.sh
@@ -29,7 +29,7 @@ test_program_prefix=$1; shift
 # internally to process the conversion requested, so any bug in our code
 # would then be verified against itself, defeating the objective of doing
 # the verification against an independent implementation.
-AWK="${AWK:-awk} -M"
+AWK="env LC_ALL=C ${AWK:-awk} -M"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-int.sh b/stdio-common/tst-printf-format-int.sh
index 8542ff4150..e9dcbedc04 100644
--- a/stdio-common/tst-printf-format-int.sh
+++ b/stdio-common/tst-printf-format-int.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-ldouble.sh b/stdio-common/tst-printf-format-ldouble.sh
index dbf78a98c6..7ee097ac0a 100644
--- a/stdio-common/tst-printf-format-ldouble.sh
+++ b/stdio-common/tst-printf-format-ldouble.sh
@@ -29,7 +29,7 @@ test_program_prefix=$1; shift
 # internally to process the conversion requested, so any bug in our code
 # would then be verified against itself, defeating the objective of doing
 # the verification against an independent implementation.
-AWK="${AWK:-awk} -M"
+AWK="env LC_ALL=C ${AWK:-awk} -M"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-llong.sh b/stdio-common/tst-printf-format-llong.sh
index e1f5252c9a..98a79660cc 100644
--- a/stdio-common/tst-printf-format-llong.sh
+++ b/stdio-common/tst-printf-format-llong.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-long.sh b/stdio-common/tst-printf-format-long.sh
index 4b68ab1e04..89ac3302b8 100644
--- a/stdio-common/tst-printf-format-long.sh
+++ b/stdio-common/tst-printf-format-long.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-s.sh b/stdio-common/tst-printf-format-s.sh
index 65aa0cb675..015c730609 100644
--- a/stdio-common/tst-printf-format-s.sh
+++ b/stdio-common/tst-printf-format-s.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 echo Verifying s
 (set -o pipefail
diff --git a/stdio-common/tst-printf-format-short.sh b/stdio-common/tst-printf-format-short.sh
index 30357baa02..a7df8b8e6d 100644
--- a/stdio-common/tst-printf-format-short.sh
+++ b/stdio-common/tst-printf-format-short.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=0
 
diff --git a/stdio-common/tst-printf-format-uchar.sh b/stdio-common/tst-printf-format-uchar.sh
index 08a6914b88..356de4217d 100644
--- a/stdio-common/tst-printf-format-uchar.sh
+++ b/stdio-common/tst-printf-format-uchar.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=0
 
diff --git a/stdio-common/tst-printf-format-uint.sh b/stdio-common/tst-printf-format-uint.sh
index 0ba203ccda..b496047a49 100644
--- a/stdio-common/tst-printf-format-uint.sh
+++ b/stdio-common/tst-printf-format-uint.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-ullong.sh b/stdio-common/tst-printf-format-ullong.sh
index 5b881ab924..f030f66a24 100644
--- a/stdio-common/tst-printf-format-ullong.sh
+++ b/stdio-common/tst-printf-format-ullong.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-ulong.sh b/stdio-common/tst-printf-format-ulong.sh
index f6aeb8e3c0..7102575ed2 100644
--- a/stdio-common/tst-printf-format-ulong.sh
+++ b/stdio-common/tst-printf-format-ulong.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=77
 
diff --git a/stdio-common/tst-printf-format-ushort.sh b/stdio-common/tst-printf-format-ushort.sh
index 07609128ab..5f612b5398 100644
--- a/stdio-common/tst-printf-format-ushort.sh
+++ b/stdio-common/tst-printf-format-ushort.sh
@@ -23,7 +23,7 @@ xprintf=$1; shift
 common_objpfx=$1; shift
 test_program_prefix=$1; shift
 
-AWK=${AWK:-awk}
+AWK="env LC_ALL=C ${AWK:-awk}"
 
 status=0
 

commit 7cc7a3a4fbf15c8a7d61a69452f754f9c352cd62
Author: Matt Turner <mattst88@gmail.com>
Date:   Mon Aug 3 21:59:44 2026 -0400

    stdio-common: avoid repeated regexp matches in tst-printf-format.awk
    
    Whether the value is an infinity, a NaN or zero does not change between
    the conversions applied to it, but was determined again for each one.
    Determine it where the value is read.
    
    Also look for the '#' flag with index() before matching the expressions
    that need it, and test the value first where both have to hold.
    
    For the %f conversion for double, in the C locale, as the median of five
    runs:
    
      x86_64, gawk 5.4.1    1.248s -> 1.184s
      x86_64, gawk 5.3.2    0.703s -> 0.708s
      alpha,  gawk 5.4.60    26.6s ->  25.8s
    
    So this only helps with the regular expression engine that gawk 5.4
    brought in; under 5.3.2 it is lost in the noise.  Output and exit status
    are unchanged for the e, f and g conversions for double under both
    gawk versions and both locales.
    
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit 0cc3f9b3f3f2950844bd41cc8923215cd5d97269)

diff --git a/stdio-common/tst-printf-format.awk b/stdio-common/tst-printf-format.awk
index 5d0324c551..57bea12621 100644
--- a/stdio-common/tst-printf-format.awk
+++ b/stdio-common/tst-printf-format.awk
@@ -32,6 +32,9 @@ BEGIN {
   # non-bignum mode unless a sign has been explicitly given.  Keep
   # original 'val' for reporting.
   value = gensub(/^(INF|NAN|inf|nan)/, "+\\1", 1, val)
+  # Neither changes between the conversions applied to this value.
+  value_infnan = value ~ /(INF|NAN|inf|nan)/
+  value_zero = value == 0
   next
 }
 
@@ -52,7 +55,7 @@ BEGIN {
   # Discard the '#' flag with the octal conversion if output starts with
   # 0 in the absence of this flag.  In that case no extra 0 is supposed
   # to be produced, but gawk prepends it anyway.
-  if (format ~ /#.*o/)
+  if (index(format, "#") && format ~ /#.*o/)
     {
       tmpfmt = gensub(/#/, "", "g", format)
       tmpout = sprintf(tmpfmt, value)
@@ -62,7 +65,7 @@ BEGIN {
   # Likewise with the hexadecimal conversion where zero value with the
   # precision of zero is supposed to produce no characters, but gawk
   # outputs 0 instead.
-  else if (format ~ /#.*[Xx]/)
+  else if (index(format, "#") && format ~ /#.*[Xx]/)
     {
       tmpfmt = gensub(/#/, "", "g", format)
       tmpout = sprintf(tmpfmt, value)
@@ -78,7 +81,7 @@ BEGIN {
   # values and reprint the output produced using the string conversion,
   # with the field width carried over and the relevant flags handled by
   # hand.
-  if (format ~ /[EFGefg]/ && value ~ /(INF|NAN|inf|nan)/)
+  if (value_infnan && format ~ /[EFGefg]/)
     {
       minus = format ~ /-/ ? "-" : ""
       sign = value ~ /-/ ? "-" : format ~ /\+/ ? "+" : format ~ / / ? " " : ""
@@ -94,7 +97,7 @@ BEGIN {
   # In that case "+" is always supposed to be produced, but with the
   # precision of zero gawk in the non-bignum mode produces any padding
   # requested only.
-  else if (format ~ /\+.*[di]/ && value == 0)
+  else if (value_zero && format ~ /\+.*[di]/)
     {
       output = gensub(/^( *) $/, format ~ /-/ ? "+\\1" : "\\1+", 1, output)
       output = gensub(/^$/, "+", 1, output)
@@ -103,7 +106,7 @@ BEGIN {
   # conversion for zero value.  In that case at least one " " is
   # supposed to be produced, but with the precision of zero gawk in the
   # non-bignum mode produces nothing.
-  else if (format ~ / .*[di]/ && value == 0)
+  else if (value_zero && format ~ / .*[di]/)
     {
       output = gensub(/^$/, " ", 1, output)
     }

commit 65d35639a9d055e423345c8748908c8aa48b19b9
Author: Magnus Lindholm <linmag7@gmail.com>
Date:   Wed Aug 5 23:14:58 2026 +0200

    string: Speed up strcmp test data initialization
    
    The strcmp and strncmp tests repeatedly initialize large buffers for
    many combinations of lengths and alignments.  The existing loops
    perform a remainder operation and two individual stores for every
    element.
    
    Generate at most max_char elements using an additive recurrence.  The
    recurrence produces the same sequence as the existing multiplication
    and remainder expression.  Expand this initial pattern using bulk
    copies, and then copy the completed first buffer to the second buffer.
    
    This preserves the generated test data while substantially reducing
    the initialization cost on slower systems.
    
    The change also applies to the wcscmp and wcsncmp tests, which include
    the same test sources.
    
    Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit 9b323b95567dff46b34157ac4455734633921abb)

diff --git a/string/test-strcmp.c b/string/test-strcmp.c
index 76ccff46e2..ca52827b11 100644
--- a/string/test-strcmp.c
+++ b/string/test-strcmp.c
@@ -156,6 +156,10 @@ do_test (size_t align1, size_t align2, size_t len, int max_char,
          int exp_result)
 {
   size_t i;
+  size_t value = 0;
+  size_t pattern_len;
+  size_t step
+    = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char;
 
   CHAR *s1, *s2;
 
@@ -179,8 +183,28 @@ do_test (size_t align1, size_t align2, size_t len, int max_char,
   i = align2 + CHARBYTES * (len + 2);
   s2 = (CHAR *)(buf2 + ((page_size - i) / 16 * 16) + align2);
 
-  for (i = 0; i < len; i++)
-    s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char;
+  /* The generated sequence repeats after at most max_char elements.  */
+  pattern_len
+    = len < (size_t) max_char ? len : (size_t) max_char;
+
+  for (i = 0; i < pattern_len; i++)
+    {
+      s1[i] = 1 + value;
+
+      value += step;
+      if (value >= (size_t) max_char)
+        value -= max_char;
+    }
+
+  while (i < len)
+    {
+      size_t copy = i < len - i ? i : len - i;
+
+      MEMCPY (s1 + i, s1, copy);
+      i += copy;
+    }
+
+  MEMCPY (s2, s1, len);
 
   s1[len] = s2[len] = 0;
   s1[len + 1] = 23;
diff --git a/string/test-strncmp.c b/string/test-strncmp.c
index 54ada39eb2..9da0f21f60 100644
--- a/string/test-strncmp.c
+++ b/string/test-strncmp.c
@@ -190,6 +190,9 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds,
 {
   size_t i, buf_bound;
   CHAR *s1, *s2, *s1_end, *s2_end;
+  size_t value = 0;
+  size_t pattern_len;
+  size_t step = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char;
 
   align1 &= ~(CHARBYTES - 1);
   align2 &= ~(CHARBYTES - 1);
@@ -216,8 +219,29 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds,
       s2[n] = 23;
     }
 
-  for (i = 0; i < buf_bound; i++)
-    s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char;
+  /* The generated sequence repeats after at most max_char elements.  */
+  pattern_len
+    = buf_bound < (size_t) max_char
+      ? buf_bound : (size_t) max_char;
+
+  for (i = 0; i < pattern_len; i++)
+    {
+      s1[i] = 1 + value;
+
+      value += step;
+      if (value >= (size_t) max_char)
+        value -= max_char;
+    }
+
+  while (i < buf_bound)
+    {
+      size_t copy = i < buf_bound - i ? i : buf_bound - i;
+
+      MEMCPY (s1 + i, s1, copy);
+      i += copy;
+    }
+
+  MEMCPY (s2, s1, buf_bound);
 
   s1[len] = 0;
   s2[len] = 0;

commit 11ac3d78fc5e4f7f2846002e099f773ad8ff82fc
Author: Magnus Lindholm <linmag7@gmail.com>
Date:   Wed Aug 5 23:14:59 2026 +0200

    string: Speed up strcasecmp test data initialization
    
    The strcasecmp and strncasecmp tests repeatedly initialize large
    buffers for many combinations of lengths and alignments.  The existing
    loops perform a remainder operation and call toupper and tolower for
    every element.
    
    Generate at most max_char elements using an additive recurrence and
    apply the case conversions while creating this initial pattern.  The
    recurrence produces the same sequence as the existing multiplication
    and remainder expression.  Expand the completed pattern using bulk
    copies.
    
    This preserves the generated test data and locale-dependent case
    conversion while substantially reducing the initialization cost on
    slower systems.
    
    Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit c1fb5d0e6b8d292ac526974d05c5adb4c3827fb0)

diff --git a/string/test-strcasecmp.c b/string/test-strcasecmp.c
index a5235fa1bb..d090dcbf36 100644
--- a/string/test-strcasecmp.c
+++ b/string/test-strcasecmp.c
@@ -63,6 +63,9 @@ do_test (size_t align1, size_t align2, size_t len, int max_char,
 	 int exp_result)
 {
   size_t i;
+  size_t value = 0;
+  size_t step = 23U % (size_t) max_char;
+  size_t pattern_len;
   char *s1, *s2;
 
   if (len == 0)
@@ -80,10 +83,25 @@ do_test (size_t align1, size_t align2, size_t len, int max_char,
   s1 = (char *) (buf1 + align1);
   s2 = (char *) (buf2 + align2);
 
-  for (i = 0; i < len; i++)
+  pattern_len
+    = len < (size_t) max_char ? len : (size_t) max_char;
+
+  for (i = 0; i < pattern_len; i++)
     {
-      s1[i] = toupper (1 + 23 * i % max_char);
+      s1[i] = toupper (1 + value);
       s2[i] = tolower (s1[i]);
+      value += step;
+      if (value >= (size_t) max_char)
+        value -= max_char;
+    }
+
+  while (i < len)
+    {
+      size_t copy = i < len - i ? i : len - i;
+
+      memcpy (s1 + i, s1, copy);
+      memcpy (s2 + i, s2, copy);
+      i += copy;
     }
 
   s1[len] = s2[len] = 0;
diff --git a/string/test-strncasecmp.c b/string/test-strncasecmp.c
index 035c680532..6b00113e66 100644
--- a/string/test-strncasecmp.c
+++ b/string/test-strncasecmp.c
@@ -83,6 +83,9 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char,
 	 int exp_result)
 {
   size_t i;
+  size_t value = 0;
+  size_t step = 23U % (size_t) max_char;
+  size_t pattern_len;
   char *s1, *s2;
 
   if (len == 0)
@@ -100,10 +103,26 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char,
   s1 = (char *) (buf1 + align1);
   s2 = (char *) (buf2 + align2);
 
-  for (i = 0; i < len; i++)
+  pattern_len
+    = len < (size_t) max_char ? len : (size_t) max_char;
+
+  for (i = 0; i < pattern_len; i++)
     {
-      s1[i] = toupper (1 + 23 * i % max_char);
+      s1[i] = toupper (1 + value);
       s2[i] = tolower (s1[i]);
+
+      value += step;
+      if (value >= (size_t) max_char)
+        value -= max_char;
+    }
+
+  while (i < len)
+    {
+      size_t copy = i < len - i ? i : len - i;
+
+      memcpy (s1 + i, s1, copy);
+      memcpy (s2 + i, s2, copy);
+      i += copy;
     }
 
   s1[len] = s2[len] = 0;

commit 16be1518495f1fa05481b0182c4e4c24927c62df
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Aug 3 11:02:53 2026 -0300

    elf: Honour skip_ifunc for cross-object IFUNC relocations [BZ #34428]
    
    Commit 63b31c05a8a ("elf: Defer all IRELATIVE relocations until after PLT
    setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming
    the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation
    that may run an IFUNC resolver.  That only holds for IFUNC symbols defined
    in the object being relocated: a reference to an IFUNC in another object is
    an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC
    nature is only known after symbol resolution inside elf_machine_rel.  Those
    relocations stay in the regular pass, which no longer propagated
    skip_ifunc, so __RTLD_NOIFUNC was ignored for them.
    
    ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so
    the resolver was called and the diagnostic emitted:
    
      $ ldd -u /bin/ls
      /bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk'
    
    ldd -r with LD_BIND_NOW is affected in the same way.
    
    Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC.
    
    This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading
    (it reads as "do not process IFUNC", yet it takes a skip_ifunc
    argument). Replace it to:
    
      DL_RELOC_BOTH     -> DL_RELOC_ALL
      DL_RELOC_NOIFUNC  -> DL_RELOC_NORMAL
      DL_RELOC_IFUNC    -> DL_RELOC_IRELATIVE
    
    ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single
    ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and
    ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three
    near-identical variants each.
    
    Checked on x86_64-linux-gnu, and built for all supported architectures.
    
    Reviewed-by: Sam James <sam@gentoo.org>
    
    (cherry picked from commit 2f2e9bae4093e1c3ba61250e340d3c3b99788f68)

diff --git a/elf/Makefile b/elf/Makefile
index 8b063e1bba..d279a5135c 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1396,6 +1396,13 @@ modules-names += \
   tst-ifunc-tls-write-lib \
   tst-tls-tdata-reloc-lib \
   # modules-names
+ifeq (yes,$(have-gcc-ifunc))
+tests += \
+  tst-ifunc-fault-dep-bindnow \
+  tst-ifunc-fault-dep-lazy \
+  # tests
+modules-names += tst-ifunc-fault-mod
+endif
 ifneq (no,$(have-test-mtls-descriptor))
 tests += tst-ifunc-tls-init-tlsdesc
 modules-names += tst-ifunc-tls-init-tlsdesc-lib
@@ -2547,6 +2554,27 @@ $(objpfx)tst-ifunc-fault-bindnow.out: $(objpfx)tst-ifunc-fault-bindnow \
    $(objpfx)ld.so
 	$(tst-ifunc-fault-script)
 
+LDFLAGS-tst-ifunc-fault-dep-lazy = -Wl,-z,lazy
+LDFLAGS-tst-ifunc-fault-dep-bindnow = -Wl,-z,now
+define tst-ifunc-fault-dep-script
+( $(test-wrapper) $(rtld-prefix) --verify $< \
+  && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 $(rtld-prefix) $< \
+  && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_DEBUG=unused \
+			 $(rtld-prefix) $< \
+  && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_WARN=yes LD_BIND_NOW=1 \
+			 $(rtld-prefix) $< \
+) > $@; $(evaluate-test)
+endef
+$(objpfx)tst-ifunc-fault-dep-lazy: $(objpfx)tst-ifunc-fault-mod.so
+$(objpfx)tst-ifunc-fault-dep-bindnow: $(objpfx)tst-ifunc-fault-mod.so
+$(objpfx)tst-ifunc-fault-dep-lazy.out: $(objpfx)tst-ifunc-fault-dep-lazy \
+   $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so
+	$(tst-ifunc-fault-dep-script)
+$(objpfx)tst-ifunc-fault-dep-bindnow.out: \
+   $(objpfx)tst-ifunc-fault-dep-bindnow \
+   $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so
+	$(tst-ifunc-fault-dep-script)
+
 LDFLAGS-tst-ifunc-plt-lib.so = -Wl,-z,lazy
 
 tst-ifunc-plt-bindnow-ENV = LD_BIND_NOW=1
diff --git a/elf/dl-reloc-static-pie.c b/elf/dl-reloc-static-pie.c
index 8463e46147..5dc5a545a8 100644
--- a/elf/dl-reloc-static-pie.c
+++ b/elf/dl-reloc-static-pie.c
@@ -80,7 +80,7 @@ _dl_relocate_static_pie (void)
 
   /* Relocate ourselves so we can do normal function calls and data access
      using the global offset table.  IRELATIVE entries are deferred.  */
-  ELF_DYNAMIC_RELOCATE_NOIFUNC (main_map, NULL, 0, 0);
+  ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, main_map, NULL, 0, 0, 0);
 
   /* Initialize _r_debug_extended.  */
   struct r_debug *r = _dl_debug_initialize (0, LM_ID_BASE);
@@ -98,7 +98,7 @@ void
 _dl_relocate_static_pie_ifunc (void)
 {
   struct link_map *main_map = _dl_get_dl_main_map ();
-  ELF_DYNAMIC_RELOCATE_IFUNC (main_map, NULL, 0, 0);
+  ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, main_map, NULL, 0, 0, 0);
   main_map->l_relocated = 1;
 }
 #endif
diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c
index 15a6a4cffe..fa2f41ac44 100644
--- a/elf/dl-reloc.c
+++ b/elf/dl-reloc.c
@@ -278,7 +278,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[],
        IFUNC resolvers.  Without this, a resolver would see the unrelocated
        initialiser bytes that were placed into the slot by the early
        _dl_allocate_tls_init.  */
-    ELF_DYNAMIC_RELOCATE_NOIFUNC (l, scope, lazy, consider_profiling);
+    ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, l, scope, lazy,
+			       consider_profiling, skip_ifunc);
 
 #ifdef SHARED
     /* Re-initialise the static TLS slot with the .tdata so the IRELATIVE
@@ -291,7 +292,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[],
       _dl_init_static_tls (l);
 #endif
 
-    ELF_DYNAMIC_RELOCATE_IFUNC (l, scope, lazy, skip_ifunc);
+    ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, l, scope, lazy,
+			       0, skip_ifunc);
 
     if ((consider_profiling || consider_symbind)
 	&& l->l_info[DT_PLTRELSZ] != NULL)
diff --git a/elf/do-rel.h b/elf/do-rel.h
index 7702244734..c610d12dbe 100644
--- a/elf/do-rel.h
+++ b/elf/do-rel.h
@@ -79,17 +79,23 @@ elf_dynamic_Rel_audit_symbind (struct link_map *map,
 /* Perform the relocations in MAP on the running program image as specified
    by RELTAG, SZTAG.  If LAZY is nonzero, this is the first pass on PLT
    relocations; they should be set up to call _dl_runtime_resolve, rather
-   than fully resolved now.
+   than fully resolved now.  If SKIP_IFUNC is nonzero no IFUNC resolver is
+   called; this is required for the trace modes (ldd -u / ldd -r), which
+   relocate objects.
 
-   IRELATIVE entries are always skipped (non-bootstrap); they are handled
+   IRELATIVE entries and relocations against an STT_GNU_IFUNC symbol defined
+   in MAP itself are always skipped (non-bootstrap); they are handled
    separately by elf_dynamic_do_Rel_irelative after all other relocations
-   for both .rel.dyn and .rel.plt have been processed.  */
+   for both .rel.dyn and .rel.plt have been processed.  Relocations against
+   an IFUNC symbol defined in *another* object are not deferred, since the
+   IFUNC symbol is only known after symbol resolution, and the defining object
+   has already been relocated at this point.  */
 
 static inline void __attribute__ ((always_inline))
 elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[],
 		    ElfW(Addr) reladdr, ElfW(Addr) relsize,
 		    __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative,
-		    int lazy)
+		    int lazy, int skip_ifunc)
 {
   const ElfW(Rel) *relative = (const void *) reladdr;
   const ElfW(Rel) *r = relative + nrelative;
@@ -111,7 +117,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[],
       void *const r_addr_arg = (void *) (l_addr + r->r_offset);
       const struct r_found_version *rversion = &map->l_versions[ndx];
 
-      elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0);
+      elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, skip_ifunc);
     }
 #else /* !RTLD_BOOTSTRAP */
 #if !defined DO_RELA || !defined ELF_MACHINE_PLT_REL
@@ -126,7 +132,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[],
 	  const ElfW (Sym) *sym = &symtab[ELFW (R_SYM) (r->r_info)];
 	  if (elf_dynamic_is_Rel_irelative (r, sym))
 	    continue;
-	  elf_machine_lazy_rel (map, scope, l_addr, r, 0);
+	  elf_machine_lazy_rel (map, scope, l_addr, r, skip_ifunc);
 	}
     }
   else
@@ -158,7 +164,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[],
 
 	      if (elf_dynamic_is_Rel_irelative (r, sym))
 		continue;
-	      elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0);
+	      elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg,
+			       skip_ifunc);
 	      elf_dynamic_Rel_audit_symbind (map, scope, r, sym, rversion,
 					     r_addr_arg);
 	    }
@@ -172,7 +179,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[],
 
 	      if (elf_dynamic_is_Rel_irelative (r, sym))
 		continue;
-	      elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg, 0);
+	      elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg,
+			       skip_ifunc);
 	      elf_dynamic_Rel_audit_symbind (map, scope, r, sym, NULL,
 					     r_addr_arg);
 	    }
diff --git a/elf/dynamic-link.h b/elf/dynamic-link.h
index 35141acec4..0130c63feb 100644
--- a/elf/dynamic-link.h
+++ b/elf/dynamic-link.h
@@ -78,18 +78,23 @@ elf_machine_lazy_rel (struct link_map *map, struct r_scope_elem *scope[],
    consumes precisely the very end of the DT_REL*, or DT_JMPREL and DT_REL*
    are completely separate and there is a gap between them.  */
 
-/* This controls which sub-passes _ELF_DYNAMIC_DO_RELOC runs.  Used to
-   interleave TLS / stack-protector setup between the two passes so IFUNC
-   resolvers see a fully-initialised TCB.  */
-enum elf_dynamic_reloc_phase
+/* Selects which relocations a pass processes.  Splitting them allows the
+   caller to interleave TLS / stack-protector setup between the two passes,
+   so IFUNC resolvers see a fully-initialised TCB.
+
+   This is orthogonal to the skip_ifunc argument, which says whether an IFUNC
+   resolver may be run at all and is honoured by every pass.  In particular
+   DL_RELOC_NORMAL also runs IFUNC resolvers, for relocations against an
+   IFUNC symbol defined in another object.  */
+enum elf_dynamic_reloc_pass
 {
-  DL_RELOC_BOTH     = 0,  /* Non-IRELATIVE pass then IRELATIVE pass.  */
-  DL_RELOC_NOIFUNC  = 1,  /* Non-IRELATIVE pass only.  */
-  DL_RELOC_IFUNC    = 2,  /* IRELATIVE pass only.  */
+  DL_RELOC_ALL	     = 0, /* Non-IRELATIVE relocations, then IRELATIVE.  */
+  DL_RELOC_NORMAL    = 1, /* Non-IRELATIVE relocations only.  */
+  DL_RELOC_IRELATIVE = 2, /* IRELATIVE relocations only.  */
 };
 
 # define _ELF_DYNAMIC_DO_RELOC(RELOC, reloc, map, scope, do_lazy, skip_ifunc, \
-			       test_rel, phase)				      \
+			       test_rel, pass)				      \
   do {									      \
     struct { ElfW(Addr) start, size;					      \
 	     __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative; int lazy; }  \
@@ -136,14 +141,15 @@ enum elf_dynamic_reloc_phase
 	 by the linker.  */						      \
       if (!DO_RTLD_BOOTSTRAP)						      \
 	{								      \
-	  if ((phase) != DL_RELOC_IFUNC)				      \
+	  if ((pass) != DL_RELOC_IRELATIVE)				      \
 	    for (int ranges_index = 0; ranges_index < 2; ++ranges_index)      \
 	      elf_dynamic_do_##reloc ((map), scope,			      \
 				      ranges[ranges_index].start,	      \
 				      ranges[ranges_index].size,	      \
 				      ranges[ranges_index].nrelative,	      \
-				      ranges[ranges_index].lazy);	      \
-	  if ((phase) != DL_RELOC_NOIFUNC)				      \
+				      ranges[ranges_index].lazy,	      \
+				      skip_ifunc);			      \
+	  if ((pass) != DL_RELOC_NORMAL)				      \
 	    for (int ranges_index = 0; ranges_index < 2; ++ranges_index)      \
 	      elf_dynamic_do_##reloc##_irelative ((map), scope,		      \
 						  ranges[ranges_index].start, \
@@ -158,7 +164,8 @@ enum elf_dynamic_reloc_phase
 				  ranges[ranges_index].start,		      \
 				  ranges[ranges_index].size,		      \
 				  ranges[ranges_index].nrelative,	      \
-				  ranges[ranges_index].lazy);		      \
+				  ranges[ranges_index].lazy,		      \
+				  skip_ifunc);				      \
   } while (0)
 
 # if ELF_MACHINE_NO_REL || ELF_MACHINE_NO_RELA
@@ -169,37 +176,21 @@ enum elf_dynamic_reloc_phase
 
 # if ! ELF_MACHINE_NO_REL
 #  include "do-rel.h"
-#  define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc)	      \
-  _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc,      \
-			 _ELF_CHECK_REL, DL_RELOC_BOTH)
-#  define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy)		      \
-  _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, 0,		      \
-			 _ELF_CHECK_REL, DL_RELOC_NOIFUNC)
-#  define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc)  \
+#  define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass)      \
   _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc,      \
-			 _ELF_CHECK_REL, DL_RELOC_IFUNC)
+			 _ELF_CHECK_REL, pass)
 # else
-#  define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc) /* Nothing to do.  */
-#  define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy) /* Nothing to do.  */
-#  define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing.  */
+#  define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass) /* Nothing.  */
 # endif
 
 # if ! ELF_MACHINE_NO_RELA
 #  define DO_RELA
 #  include "do-rel.h"
-#  define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc)	      \
-  _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc,    \
-			 _ELF_CHECK_REL, DL_RELOC_BOTH)
-#  define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy)		      \
-  _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, 0,	      \
-			 _ELF_CHECK_REL, DL_RELOC_NOIFUNC)
-#  define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) \
+#  define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass)     \
   _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc,    \
-			 _ELF_CHECK_REL, DL_RELOC_IFUNC)
+			 _ELF_CHECK_REL, pass)
 # else
-#  define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc) /* Nothing to do.  */
-#  define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy) /* Nothing to do.  */
-#  define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing.  */
+#  define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass) /* Nothing.  */
 # endif
 
 # define ELF_DYNAMIC_DO_RELR(map)					      \
@@ -240,37 +231,33 @@ enum elf_dynamic_reloc_phase
 # else
 #  define DO_RTLD_BOOTSTRAP 0
 # endif
-# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \
-  do {									      \
-    int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy),	      \
-					      (consider_profile));	      \
-    if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP)			      \
-      ELF_DYNAMIC_DO_RELR (map);					      \
-    ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc);		      \
-    ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc);		      \
-    ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy));			      \
-  } while (0)
+/* Perform one relocation pass over MAP.  PASS selects which relocations are
+   processed.  It is orthogonal to SKIP_IFUNC, which suppresses running IFUNC
+   resolvers in whichever pass is selected.
 
-/* Like ELF_DYNAMIC_RELOCATE but only processes the non-IRELATIVE pass.
-   The IRELATIVE pass must be completed later via ELF_DYNAMIC_RELOCATE_IFUNC.
-   Used by the static-pie startup so the TCB and stack-protector canary can
-   be initialised between the two passes.  */
-# define ELF_DYNAMIC_RELOCATE_NOIFUNC(map, scope, lazy, consider_profile)     \
+   Unless PASS is DL_RELOC_IRELATIVE, this also performs the machine-specific
+   PLT/GOT setup, the DT_RELR relocations, and the ELF_DYNAMIC_AFTER_RELOC
+   hook.  */
+# define ELF_DYNAMIC_RELOCATE_PASS(pass, map, scope, lazy, consider_profile,  \
+				   skip_ifunc)				      \
   do {									      \
-    int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy),	      \
+    int edr_lazy = (lazy);						      \
+    if ((pass) != DL_RELOC_IRELATIVE)					      \
+      {									      \
+	edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy),	      \
 					      (consider_profile));	      \
-    if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP)			      \
-      ELF_DYNAMIC_DO_RELR (map);					      \
-    ELF_DYNAMIC_DO_REL_NOIFUNC ((map), (scope), edr_lazy);		      \
-    ELF_DYNAMIC_DO_RELA_NOIFUNC ((map), (scope), edr_lazy);		      \
-    ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy));			      \
+	if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP)		      \
+	  ELF_DYNAMIC_DO_RELR (map);					      \
+      }									      \
+    ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc, (pass));	      \
+    ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc, (pass));	      \
+    if ((pass) != DL_RELOC_IRELATIVE)					      \
+      ELF_DYNAMIC_AFTER_RELOC ((map), edr_lazy);			      \
   } while (0)
 
-/* IRELATIVE-only companion to ELF_DYNAMIC_RELOCATE_NOIFUNC.  */
-# define ELF_DYNAMIC_RELOCATE_IFUNC(map, scope, lazy, skip_ifunc)	      \
-  do {									      \
-    ELF_DYNAMIC_DO_REL_IFUNCONLY ((map), (scope), (lazy), skip_ifunc);	      \
-    ELF_DYNAMIC_DO_RELA_IFUNCONLY ((map), (scope), (lazy), skip_ifunc);	      \
-  } while (0)
+/* Run both passes back to back, for callers with nothing to interleave.  */
+# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \
+  ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_ALL, (map), (scope), (lazy),	      \
+			     (consider_profile), skip_ifunc)
 
 #endif
diff --git a/elf/tst-ifunc-fault-dep-bindnow.c b/elf/tst-ifunc-fault-dep-bindnow.c
new file mode 100644
index 0000000000..60d97dcaa4
--- /dev/null
+++ b/elf/tst-ifunc-fault-dep-bindnow.c
@@ -0,0 +1,19 @@
+/* Program calling an IFUNC defined in a dependency.  BIND_NOW variant.
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include "tst-ifunc-fault-dep-lazy.c"
diff --git a/elf/tst-ifunc-fault-dep-lazy.c b/elf/tst-ifunc-fault-dep-lazy.c
new file mode 100644
index 0000000000..122d33f391
--- /dev/null
+++ b/elf/tst-ifunc-fault-dep-lazy.c
@@ -0,0 +1,27 @@
+/* Program calling an IFUNC defined in a dependency (BZ 34428).
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+extern void magic (void);
+
+int
+main (void)
+{
+  /* JMP_SLOT relocation against an undefined symbol.  */
+  magic ();
+  return 1;
+}
diff --git a/elf/tst-ifunc-fault-mod.c b/elf/tst-ifunc-fault-mod.c
new file mode 100644
index 0000000000..11c21b48ac
--- /dev/null
+++ b/elf/tst-ifunc-fault-mod.c
@@ -0,0 +1,38 @@
+/* Shared object exporting an IFUNC symbol with a resolver which crashes.
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <stddef.h>
+
+static void
+implementation (void)
+{
+  /* Produce a crash, without depending on any relocations.  */
+  volatile char *volatile p = NULL;
+  *p = 0;
+}
+
+static __typeof__ (implementation) *
+resolver (void)
+{
+  /* Produce a crash, without depending on any relocations.  */
+  volatile char *volatile p = NULL;
+  *p = 0;
+  return implementation;
+}
+
+void magic (void) __attribute__ ((ifunc ("resolver")));

commit afd131806b25715a7617ab757db43f0bb610acbf
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Aug 12 09:03:17 2026 -0300

    m68k: Fix fmod/fmodf infinite recursion (BZ 34508)
    
    Commits 6deadd4eb6a and ade9f30ce27 changed m68k fmod to call
    __m81_u(fmod), instead of the mathimpl.h inline
    __m81_u(__ieee754_fmod) (that wraps the m68k fmod instruction).
    This leads to infinite recursion.
    
    Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
    
    (cherry picked from commit bb213471bedc177b8efd3178584137fb81cc976a)

diff --git a/NEWS b/NEWS
index d0ef2d3e9a..697049efd1 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,8 @@ The following bugs are resolved with this release:
   [34441] math: math: sinh() returns wrong results for some inputs with
     |x| > 36.736801
   [34465] math: math: x86_64 tanh ifunc selection wrong
+  [34509] libc: [m68k] Regression: Perl locks up after upgrading glibc
+    to 2.43
 
 Version 2.44
 
diff --git a/sysdeps/m68k/m680x0/fpu/e_fmod.c b/sysdeps/m68k/m680x0/fpu/e_fmod.c
index 9ad6924422..faac7c79e3 100644
--- a/sysdeps/m68k/m680x0/fpu/e_fmod.c
+++ b/sysdeps/m68k/m680x0/fpu/e_fmod.c
@@ -33,7 +33,7 @@ __fmod (double x, double y)
 			&& !is_nan (hx)))
     return __math_invalid (x);
 
-  return __m81_u(fmod)(x, y);
+  return __m81_u(__ieee754_fmod)(x, y);
 }
 strong_alias (__fmod, __ieee754_fmod)
 libm_alias_finite (__ieee754_fmod, __fmod)
diff --git a/sysdeps/m68k/m680x0/fpu/e_fmodf.c b/sysdeps/m68k/m680x0/fpu/e_fmodf.c
index a3bd24b71f..98797e0887 100644
--- a/sysdeps/m68k/m680x0/fpu/e_fmodf.c
+++ b/sysdeps/m68k/m680x0/fpu/e_fmodf.c
@@ -34,7 +34,7 @@ __fmodf (float x, float y)
 			&& !is_nan (hx)))
     return __math_invalidf (x);
 
-  return __m81_u(fmodf)(x, y);
+  return __m81_u(__ieee754_fmodf)(x, y);
 }
 strong_alias (__fmodf, __ieee754_fmodf)
 versioned_symbol (libm, __fmodf, fmodf, GLIBC_2_43);

commit d6ff274313d79feb864cc10eb775b91c817a67e9
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Aug 14 13:41:16 2026 +0200

    misc: Fix out-of-bounds array write in tdelete (bug 34506)
    
    Allocate the maximum array sizes directly, instead of resizing
    the arrays as needed.  This eliminates alloca usage from the
    function, and fixes the out-of-bounds accesses.  The asserts
    guard against the bug coming back if the balancing of the tree
    turns out not to work correctly.
    
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3)

diff --git a/misc/tsearch.c b/misc/tsearch.c
index 9b2eb34b25..e517dfa712 100644
--- a/misc/tsearch.c
+++ b/misc/tsearch.c
@@ -85,6 +85,7 @@
 #include <assert.h>
 #include <stdalign.h>
 #include <stddef.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <search.h>
@@ -406,12 +407,13 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
   int cmp;
   node *rootp = (node *) vrootp;
   node root, unchained;
-  /* Stack of nodes so we remember the parents without recursion.  It's
-     _very_ unlikely that there are paths longer than 40 nodes.  The tree
-     would need to have around 250.000 nodes.  */
-  int stacksize = 40;
+  /* Stack of nodes so we remember the parents without recursion.  The
+     stack size is a conservative approximation of the maximum height
+     of a red-black tree, based on size of the address space.
+     Actual numbers are closer to 57 (32 bit) and 117 (63 bit).  */
+  enum { stacksize = 2 * UINTPTR_WIDTH };
   int sp = 0;
-  node **nodestack = alloca (sizeof (node *) * stacksize);
+  node *nodestack[stacksize];
 
   if (rootp == NULL)
     return NULL;
@@ -424,14 +426,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
   root = DEREFNODEPTR(rootp);
   while ((cmp = (*compar) (key, root->key)) != 0)
     {
-      if (sp == stacksize)
-	{
-	  node **newstack;
-	  stacksize += 20;
-	  newstack = alloca (sizeof (node *) * stacksize);
-	  nodestack = memcpy (newstack, nodestack, sp * sizeof (node *));
-	}
-
+      assert (sp < stacksize);
       nodestack[sp++] = rootp;
       p = DEREFNODEPTR(rootp);
       if (cmp < 0)
@@ -470,13 +465,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
       node upn;
       for (;;)
 	{
-	  if (sp == stacksize)
-	    {
-	      node **newstack;
-	      stacksize += 20;
-	      newstack = alloca (sizeof (node *) * stacksize);
-	      nodestack = memcpy (newstack, nodestack, sp * sizeof (node *));
-	    }
+	  assert (sp < stacksize);
 	  nodestack[sp++] = parentp;
 	  parentp = up;
 	  upn = DEREFNODEPTR(up);
@@ -541,6 +530,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
 		  SETNODEPTR(pp,q);
 		  /* Make sure pp is right if the case below tries to use
 		     it.  */
+		  assert (sp < stacksize);
 		  nodestack[sp++] = pp = LEFTPTR(q);
 		  q = RIGHT(p);
 		}
@@ -625,6 +615,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
 		  SETLEFT(p,RIGHT(q));
 		  SETRIGHT(q,p);
 		  SETNODEPTR(pp,q);
+		  assert (sp < stacksize);
 		  nodestack[sp++] = pp = RIGHTPTR(q);
 		  q = LEFT(p);
 		}

commit ae9225d55963c4420c49ccfa3f2fafc416f92032
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Mon Aug 24 18:00:26 2026 +0200

    m68k: remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c (bug 34559)
    
    This was missed from commit 6deadd4eb6.
    
    (cherry picked from commit ff1c5580610dee6d743169fc0f6684505d372dc9)

diff --git a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c b/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c
deleted file mode 100644
index 57f38091e6..0000000000
--- a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c
+++ /dev/null
@@ -1,15 +0,0 @@
-/* m68k provides an optimized __ieee752_fmod.  */
-#include <math-svid-compat.h>
-#ifdef SHARED
-# undef SHLIB_COMPAT
-# define SHLIB_COMPAT(a, b, c) 1
-# undef LIBM_SVID_COMPAT
-# define LIBM_SVID_COMPAT 1
-# undef compat_symbol
-# define compat_symbol(a, b, c, d)
-#include <math/w_fmod_compat.c>
-libm_alias_double (__fmod_compat, fmod)
-#else
-#include <math-type-macros-double.h>
-#include <w_fmod_template.c>
-#endif
