commit 5e5ddf57987ae4b37da5ca2fa039c8803b0be735 Author: Andreas K. Hüttel Date: Sat Jul 25 09:20:26 2026 +0900 advisories: replace with ADVISORIES text file Signed-off-by: Andreas K. Hüttel diff --git a/ADVISORIES b/ADVISORIES new file mode 100644 index 0000000000..d4e33f2df3 --- /dev/null +++ b/ADVISORIES @@ -0,0 +1,2 @@ +For the GNU C Library Security Advisories, see the git master branch: +https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 deleted file mode 100644 index 3d19c91b6a..0000000000 --- a/advisories/GLIBC-SA-2023-0001 +++ /dev/null @@ -1,14 +0,0 @@ -printf: incorrect output for integers with thousands separator and width field - -When the printf family of functions is called with a format specifier -that uses an (enable grouping) and a minimum width -specifier, the resulting output could be larger than reasonably expected -by a caller that computed a tight bound on the buffer size. The -resulting larger than expected output could result in a buffer overflow -in the printf family of functions. - -CVE-Id: CVE-2023-25139 -Public-Date: 2023-02-02 -Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) -Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) -Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 deleted file mode 100644 index 5122669a64..0000000000 --- a/advisories/GLIBC-SA-2023-0002 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Stack read overflow in no-aaaa mode - -If the system is configured in no-aaaa mode via /etc/resolv.conf, -getaddrinfo is called for the AF_UNSPEC address family, and a DNS -response is received over TCP that is larger than 2048 bytes, -getaddrinfo may potentially disclose stack contents via the returned -address data, or crash. - -CVE-Id: CVE-2023-4527 -Public-Date: 2023-09-12 -Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) -Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) -Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) -Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) -Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 deleted file mode 100644 index d3aef80348..0000000000 --- a/advisories/GLIBC-SA-2023-0003 +++ /dev/null @@ -1,15 +0,0 @@ -getaddrinfo: Potential use-after-free - -When an NSS plugin only implements the _gethostbyname2_r and -_getcanonname_r callbacks, getaddrinfo could use memory that was freed -during buffer resizing, potentially causing a crash or read or write to -arbitrary memory. - -CVE-Id: CVE-2023-4806 -Public-Date: 2023-09-12 -Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) -Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 deleted file mode 100644 index 5286a7aa54..0000000000 --- a/advisories/GLIBC-SA-2023-0004 +++ /dev/null @@ -1,16 +0,0 @@ -tunables: local privilege escalation through buffer overflow - -If a tunable of the form NAME=NAME=VAL is passed in the environment of a -setuid program and NAME is valid, it may result in a buffer overflow, -which could be exploited to achieve escalated privileges. This flaw was -introduced in glibc 2.34. - -CVE-Id: CVE-2023-4911 -Public-Date: 2023-10-03 -Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) -Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) -Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) -Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) -Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) -Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) -Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 deleted file mode 100644 index cc4eb90b82..0000000000 --- a/advisories/GLIBC-SA-2023-0005 +++ /dev/null @@ -1,18 +0,0 @@ -getaddrinfo: DoS due to memory leak - -The fix for CVE-2023-4806 introduced a memory leak when an application -calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED -flags set. - -CVE-Id: CVE-2023-5156 -Public-Date: 2023-09-25 -Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) -Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) -Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) -Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) -Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) -Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) -Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) -Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) -Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) -Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001 deleted file mode 100644 index 28931c75ae..0000000000 --- a/advisories/GLIBC-SA-2024-0001 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER -containing a long program name failed to update the required buffer -size, leading to the allocation and overflow of a too-small buffer on -the heap. - -CVE-Id: CVE-2023-6246 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39) -Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42) -Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126) diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002 deleted file mode 100644 index 940bfcf2fc..0000000000 --- a/advisories/GLIBC-SA-2024-0002 +++ /dev/null @@ -1,15 +0,0 @@ -syslog: Heap buffer overflow in __vsyslog_internal - -__vsyslog_internal used the return value of snprintf/vsnprintf to -calculate buffer sizes for memory allocation. If these functions (for -any reason) failed and returned -1, the resulting buffer would be too -small to hold output. - -CVE-Id: CVE-2023-6779 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39) -Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43) -Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127) diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003 deleted file mode 100644 index b43a5150ab..0000000000 --- a/advisories/GLIBC-SA-2024-0003 +++ /dev/null @@ -1,13 +0,0 @@ -syslog: Integer overflow in __vsyslog_internal - -__vsyslog_internal calculated a buffer size by adding two integers, but -did not first check if the addition would overflow. - -CVE-Id: CVE-2023-6780 -Public-Date: 2024-01-30 -Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) -Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39) -Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44) -Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59) -Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) -Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128) diff --git a/advisories/GLIBC-SA-2024-0004 b/advisories/GLIBC-SA-2024-0004 deleted file mode 100644 index 08df2b3118..0000000000 --- a/advisories/GLIBC-SA-2024-0004 +++ /dev/null @@ -1,28 +0,0 @@ -ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence - -The iconv() function in the GNU C Library versions 2.39 and older may -overflow the output buffer passed to it by up to 4 bytes when converting -strings to the ISO-2022-CN-EXT character set, which may be used to -crash an application or overwrite a neighbouring variable. - -ISO-2022-CN-EXT uses escape sequences to indicate character set changes -(as specified by RFC 1922). While the SOdesignation has the expected -bounds checks, neither SS2designation nor SS3designation have its; -allowing a write overflow of 1, 2, or 3 bytes with fixed values: -'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. - -CVE-Id: CVE-2024-2961 -Public-Date: 2024-04-17 -Vulnerable-Commit: 755104edc75c53f4a0e7440334e944ad3c6b32fc (2.1.93-169) -Fix-Commit: f9dc609e06b1136bb0408be9605ce7973a767ada (2.40) -Fix-Commit: 31da30f23cddd36db29d5b6a1c7619361b271fb4 (2.39-31) -Fix-Commit: e1135387deded5d73924f6ca20c72a35dc8e1bda (2.38-66) -Fix-Commit: 89ce64b269a897a7780e4c73a7412016381c6ecf (2.37-89) -Fix-Commit: 4ed98540a7fd19f458287e783ae59c41e64df7b5 (2.36-164) -Fix-Commit: 36280d1ce5e245aabefb877fe4d3c6cff95dabfa (2.35-315) -Fix-Commit: a8b0561db4b9847ebfbfec20075697d5492a363c (2.34-459) -Fix-Commit: ed4f16ff6bed3037266f1fa682ebd32a18fce29c (2.33-263) -Fix-Commit: 682ad4c8623e611a971839990ceef00346289cc9 (2.32-140) -Fix-Commit: 3703c32a8d304c1ee12126134ce69be965f38000 (2.31-154) - -Reported-By: Charles Fol diff --git a/advisories/GLIBC-SA-2024-0005 b/advisories/GLIBC-SA-2024-0005 deleted file mode 100644 index a59596610a..0000000000 --- a/advisories/GLIBC-SA-2024-0005 +++ /dev/null @@ -1,22 +0,0 @@ -nscd: Stack-based buffer overflow in netgroup cache - -If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted -by client requests then a subsequent client request for netgroup data -may result in a stack-based buffer overflow. This flaw was introduced -in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33599 -Public-Date: 2024-04-23 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: 69c58d5ef9f584ea198bd00f7964d364d0e6b921 (2.31-155) -Fix-Commit: a77064893bfe8a701770e2f53a4d33805bc47a5a (2.32-141) -Fix-Commit: 5c75001a96abcd50cbdb74df24c3f013188d076e (2.33-264) -Fix-Commit: 52f73e5c4e29b14e79167272297977f360ae1e97 (2.34-460) -Fix-Commit: 7a95873543ce225376faf13bb71c43dea6d24f86 (2.35-316) -Fix-Commit: caa3151ca460bdd9330adeedd68c3112d97bffe4 (2.36-165) -Fix-Commit: f75c298e747b2b8b41b1c2f551c011a52c41bfd1 (2.37-91) -Fix-Commit: 5968aebb86164034b8f8421b4abab2f837a5bdaf (2.38-72) -Fix-Commit: 1263d583d2e28afb8be53f8d6922f0842036f35d (2.39-35) -Fix-Commit: 87801a8fd06db1d654eea3e4f7626ff476a9bdaa (2.40) diff --git a/advisories/GLIBC-SA-2024-0006 b/advisories/GLIBC-SA-2024-0006 deleted file mode 100644 index d44148d3d9..0000000000 --- a/advisories/GLIBC-SA-2024-0006 +++ /dev/null @@ -1,32 +0,0 @@ -nscd: Null pointer crash after notfound response - -If the Name Service Cache Daemon's (nscd) cache fails to add a not-found -netgroup response to the cache, the client request can result in a null -pointer dereference. This flaw was introduced in glibc 2.15 when the -cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -CVE-Id: CVE-2024-33600 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: b048a482f088e53144d26a61c390bed0210f49f2 (2.40) -Fix-Commit: 7835b00dbce53c3c87bbbb1754a95fb5e58187aa (2.40) -Fix-Commit: c99f886de54446cd4447db6b44be93dabbdc2f8b (2.39-37) -Fix-Commit: 5a508e0b508c8ad53bd0d2fb48fd71b242626341 (2.39-36) -Fix-Commit: 2ae9446c1b7a3064743b4a51c0bbae668ee43e4c (2.38-74) -Fix-Commit: 541ea5172aa658c4bd5c6c6d6fd13903c3d5bb0a (2.38-73) -Fix-Commit: a8070b31043c7585c36ba68a74298c4f7af075c3 (2.37-93) -Fix-Commit: 5eea50c4402e39588de98aa1d4469a79774703d4 (2.37-92) -Fix-Commit: f205b3af56740e3b014915b1bd3b162afe3407ef (2.36-167) -Fix-Commit: c34f470a615b136170abd16142da5dd0c024f7d1 (2.36-166) -Fix-Commit: bafadc589fbe21ae330e8c2af74db9da44a17660 (2.35-318) -Fix-Commit: 4370bef52b0f3f3652c6aa13d7a9bb3ac079746d (2.35-317) -Fix-Commit: 1f94122289a9bf7dba573f5d60327aaa2b85cf2e (2.34-462) -Fix-Commit: 966d6ac9e40222b84bb21674cc4f83c8d72a5a26 (2.34-461) -Fix-Commit: e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 (2.33-266) -Fix-Commit: f20a8d696b13c6261b52a6434899121f8b19d5a7 (2.33-265) -Fix-Commit: be602180146de37582a3da3a0caa4b719645de9c (2.32-143) -Fix-Commit: 394eae338199078b7961b051c191539870742d7b (2.32-142) -Fix-Commit: 8d7949183760170c61e55def723c1d8050187874 (2.31-157) -Fix-Commit: 304ce5fe466c4762b21b36c26926a4657b59b53e (2.31-156) diff --git a/advisories/GLIBC-SA-2024-0007 b/advisories/GLIBC-SA-2024-0007 deleted file mode 100644 index b6928fa27a..0000000000 --- a/advisories/GLIBC-SA-2024-0007 +++ /dev/null @@ -1,28 +0,0 @@ -nscd: netgroup cache may terminate daemon on memory allocation failure - -The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or -xrealloc and these functions may terminate the process due to a memory -allocation failure resulting in a denial of service to the clients. The -flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -Subsequent refactoring of the netgroup cache only added more uses of -xmalloc and xrealloc. Uses of xmalloc and xrealloc in other parts of -nscd only occur during startup of the daemon and so are not affected by -client requests that could trigger an out of memory followed by -termination. - -CVE-Id: CVE-2024-33601 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2024-0008 b/advisories/GLIBC-SA-2024-0008 deleted file mode 100644 index d93e2a6f0b..0000000000 --- a/advisories/GLIBC-SA-2024-0008 +++ /dev/null @@ -1,26 +0,0 @@ -nscd: netgroup cache assumes NSS callback uses in-buffer strings - -The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory -when the NSS callback does not store all strings in the provided buffer. -The flaw was introduced in glibc 2.15 when the cache was added to nscd. - -This vulnerability is only present in the nscd binary. - -There is no guarantee from the NSS callback API that the returned -strings are all within the buffer. However, the netgroup cache code -assumes that the NSS callback uses in-buffer strings and if it doesn't -the buffer resizing logic could lead to potential memory corruption. - -CVE-Id: CVE-2024-33602 -Public-Date: 2024-04-24 -Vulnerable-Commit: 684ae515993269277448150a1ca70db3b94aa5bd (2.15) -Fix-Commit: c04a21e050d64a1193a6daab872bca2528bda44b (2.40) -Fix-Commit: a9a8d3eebb145779a18d90e3966009a1daa63cd8 (2.39-38) -Fix-Commit: 71af8ca864345d39b746d5cee84b94b430fad5db (2.38-75) -Fix-Commit: 6e106dc214d6a033a4e945d1c6cf58061f1c5f1f (2.37-94) -Fix-Commit: b6742463694b1dfdd5120b91ee21cf05d15ec2e2 (2.36-168) -Fix-Commit: 7a5864cac60e06000394128a5a2817b03542f5a3 (2.35-319) -Fix-Commit: 86f1d5f4129c373ac6fb6df5bcf38273838843cb (2.34-463) -Fix-Commit: 4d27d4b9a188786fc6a56745506cec2acfc51f83 (2.33-267) -Fix-Commit: 3ed195a8ec89da281e3c4bf887a13d281b72d8f4 (2.32-144) -Fix-Commit: bbf5a58ccb55679217f94de706164d15372fbbc0 (2.31-158) diff --git a/advisories/GLIBC-SA-2025-0001 b/advisories/GLIBC-SA-2025-0001 deleted file mode 100644 index b053d32e91..0000000000 --- a/advisories/GLIBC-SA-2025-0001 +++ /dev/null @@ -1,40 +0,0 @@ -assert: Buffer overflow when printing assertion failure message - -When the assert() function fails, it does not allocate enough space for the -assertion failure message string and size information, which may lead to a -buffer overflow if the message string size aligns to page size. - -This bug can be triggered when an assertion in a program fails. The assertion -failure message is allocated to allow developers to see this failure in core -dumps and it typically includes, in addition to the invariant assertion -string and function name, the name of the program. If the name of the failing -program is user controlled, for example on a local system, this could allow an -attacker to control the assertion failure to trigger this buffer overflow. - -The only viable vector for exploitation of this bug is local, if a setuid -program exists that has an existing bug that results in an assertion failure. -No such program has been discovered at the time of publishing this advisory, -but the presence of custom setuid programs, although strongly discouraged as a -security practice, cannot be discounted. - -CVE-Id: CVE-2025-0395 -Public-Date: 2025-01-22 -Vulnerable-Commit: f8a3b5bf8fa1d0c43d2458e03cc109a04fdef194 (2.13-175) -Fix-Commit: 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578 (2.41) -Fix-Commit: cdb9ba84191ce72e86346fb8b1d906e7cd930ea2 (2.42) -Fix-Commit: 69fda28279b497bd405fdd442a6d8e4d3d5f681b (2.41-7) -Fix-Commit: 7d4b6bcae91f29d7b4daf15bab06b66cf1d2217c (2.40-66) -Fix-Commit: d6c156c326999f144cb5b73d29982108d549ad8a (2.40-71) -Fix-Commit: 808a84a8b81468b517a4d721fdc62069cb8c211f (2.39-146) -Fix-Commit: f6d48470aef9264d2d56f4c4533eb76db7f9c2e4 (2.39-150) -Fix-Commit: c32fd59314c343db88c3ea4a203870481d33c3d2 (2.38-122) -Fix-Commit: f984e2d7e8299726891a1a497a3c36cd5542a0bf (2.38-124) -Fix-Commit: a3d7865b098a3a67c44f7812208d9ce4718873ba (2.37-143) -Fix-Commit: b989519fe1683c204ac24ec92830e3fe3bfaccad (2.37-146) -Fix-Commit: 7971add7ee4171fdd8dfd17e7c04c4ed77a18845 (2.36-216) -Fix-Commit: 0487893d5c5bc6710d83d7c3152d888a0339559e (2.36-219) -Fix-Commit: 8b5d4be762419c4f6176261c6fea40ac559b88dc (2.35-370) -Fix-Commit: 8b3d09dc0d350191985f9d291cc30ce96f034b49 (2.35-373) -Fix-Commit: df4e1f4a5096b385c9bcc94424cf2eaa227b3761 (2.34-500) -Fix-Commit: 31eb872cb21449832ab47ad5db83281d240e1d03 (2.34-503) -Reported-By: Qualys Security Advisory diff --git a/advisories/GLIBC-SA-2025-0002 b/advisories/GLIBC-SA-2025-0002 deleted file mode 100644 index 161da13dd4..0000000000 --- a/advisories/GLIBC-SA-2025-0002 +++ /dev/null @@ -1,23 +0,0 @@ -elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH - -A statically linked setuid binary that calls dlopen (including internal -dlopen calls after setlocale or calls to NSS functions such as getaddrinfo) -may incorrectly search LD_LIBRARY_PATH to determine which library to load, -leading to the execution of library code that is attacker controlled. - -The only viable vector for exploitation of this bug is local, if a static -setuid program exists, and that program calls dlopen, then it may search -LD_LIBRARY_PATH to locate the SONAME to load. No such program has been -discovered at the time of publishing this advisory, but the presence of -custom setuid programs, although strongly discouraged as a security -practice, cannot be discounted. - -CVE-Id: CVE-2025-4802 -Public-Date: 2025-05-16 -Vulnerable-Commit: 10e93d968716ab82931d593bada121c17c0a4b93 (2.27) -Fix-Commit: 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 (2.39) -Fix-Commit: 3be3728df2f1912c80abd3288bc6e3a25ad679e4 (2.38-132) -Fix-Commit: 7403ede2d7752e59e0c47d5d33d73c2bf850e7be (2.37-154) -Fix-Commit: 2ef7850279b2931caf6d6d6743ebaa91839e1cf7 (2.36-227) -Fix-Commit: 621c65ccf12ddd415ceeb2234423bd1acd0fabb3 (2.35-387) -Fix-Commit: 35018c0fd20eac9ceaf60060fed2745b3177359d (2.34-517) diff --git a/advisories/GLIBC-SA-2025-0003 b/advisories/GLIBC-SA-2025-0003 deleted file mode 100644 index 2adeb3ce00..0000000000 --- a/advisories/GLIBC-SA-2025-0003 +++ /dev/null @@ -1,30 +0,0 @@ -power10: strcmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strcmp in -sysdeps/powerpc/powerpc64/le/power10/strcmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strcmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strcmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5702 -Public-Date: 2025-06-04 -Vulnerable-Commit: 3367d8e180848030d1646f088759f02b8dfe0d6f (2.39) -Fix-Commit: 15808c77b35319e67ee0dc8f984a9a1a434701bc (2.42) -Fix-Commit: 0c76c951620f9e12df2a89b2c684878b55bb6795 (2.41-60) -Fix-Commit: 7e12550b8e3a11764a4a9090ce6bd3fc23fc8a8e (2.40-139) -Fix-Commit: 06a70769fd0b2e1f2a3085ad50ab620282bd77b3 (2.39-209) diff --git a/advisories/GLIBC-SA-2025-0004 b/advisories/GLIBC-SA-2025-0004 deleted file mode 100644 index 9409ca27c4..0000000000 --- a/advisories/GLIBC-SA-2025-0004 +++ /dev/null @@ -1,29 +0,0 @@ -power10: strncmp fails to save and restore nonvolatile vector registers - -The Power 10 implementation of strncmp in -sysdeps/powerpc/powerpc64/le/power10/strncmp.S failed to save/restore -nonvolatile vector registers in the 32-byte aligned loop path. This -results in callers reading content from those registers in a different -context, potentially altering program logic. - -There could be a program context where a user controlled string could -leak through strncmp into program code, thus altering its logic. There -is also a potential for sensitive strings passed into strncmp leaking -through the clobbered registers into parts of the calling program that -should otherwise not have had access to those strings. - -The impact of this flaw is limited to applications running on Power 10 -hardware that use the nonvolatile vector registers, i.e. v20 to v31 -assuming that they have been treated in accordance with the OpenPower -psABI. It is possible to work around the issue for those specific -applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like -so: - - export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 - -CVE-Id: CVE-2025-5745 -Public-Date: 2025-06-05 -Vulnerable-Commit: 23f0d81608d0ca6379894ef81670cf30af7fd081 (2.40) -Fix-Commit: 63c60101ce7c5eac42be90f698ba02099b41b965 (2.42) -Fix-Commit: 84bdbf8a6f2fdafd3661489dbb7f79835a52da82 (2.41-57) -Fix-Commit: 42a5a940c974d02540c8da26d6374c744d148cb9 (2.40-136) diff --git a/advisories/GLIBC-SA-2025-0005 b/advisories/GLIBC-SA-2025-0005 deleted file mode 100644 index 8bcccc59a5..0000000000 --- a/advisories/GLIBC-SA-2025-0005 +++ /dev/null @@ -1,14 +0,0 @@ -posix: Fix double-free after allocation failure in regcomp - -The regcomp function in the GNU C library version from 2.4 to 2.41 is -subject to a double free if some previous allocation fails. It can be -accomplished either by a malloc failure or by using an interposed -malloc that injects random malloc failures. The double free can allow -buffer manipulation depending of how the regex is constructed. -This issue affects all architectures and ABIs supported by the GNU C -library. - -CVE-Id: CVE-2025-8058 -Public-Date: 2025-07-22 -Vulnerable-Commit: 963d8d782fc98fb6dc3a66f0068795f9920c269d (2.3.3-1596) -Fix-Commit: 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d (2.42) diff --git a/advisories/GLIBC-SA-2026-0001 b/advisories/GLIBC-SA-2026-0001 deleted file mode 100644 index 3e0ee3b3f4..0000000000 --- a/advisories/GLIBC-SA-2026-0001 +++ /dev/null @@ -1,41 +0,0 @@ -Integer overflow in memalign leads to heap corruption - -Passing too large an alignment to the memalign suite of functions -(memalign, posix_memalign, aligned_alloc) in the GNU C Library version -2.30 to 2.42 may result in an integer overflow, which could consequently -result in a heap corruption. - -Note that the attacker must have control over both, the size as well as -the alignment arguments of the memalign function to be able to exploit -this. The size parameter must be close enough to PTRDIFF_MAX so as to -overflow size_t along with the large alignment argument. This limits -the malicious inputs for the alignment for memalign to the range [1<<62 -+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. - -Typically the alignment argument passed to such functions is a known -constrained quantity (e.g. page size, block size, struct sizes) and is -not attacker controlled, because of which this may not be easily -exploitable in practice. An application bug could potentially result in -the input alignment being too large, e.g. due to a different buffer -overflow or integer overflow in the application or its dependent -libraries, but that is again an uncommon usage pattern given typical -sources of alignments. - -CVE-Id: CVE-2026-0861 -Public-Date: 2026-01-14 -Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206 (2.30) -Fix-Commit: c9188d333717d3ceb7e3020011651f424f749f93 (2.43) -Fix-Commit: 7f19ef14fbce095d4c77395e258320cad2ea2b28 (2.30-153) -Fix-Commit: f18446d7b4a423090ee5e328c36b3c2a0f26041c (2.31-166) -Fix-Commit: 8aef9e7a7af9565c0324b4ecb38b30dfa3782fd8 (2.32-151) -Fix-Commit: 011293b4fd748cdd6f95874ba2b6aba9a3df8bff (2.33-275) -Fix-Commit: 2c77e52108a58956c9f674b36e1f59a4e3fdcf4d (2.34-525) -Fix-Commit: 499d1ccafccfe64df1b88deea2fa84d8180e8e8f (2.35-399) -Fix-Commit: fb6b8822175769b5794fb6ea04f2895483a29b61 (2.36-244) -Fix-Commit: 7b913d41a07836def826f2164c52541a9835f324 (2.37-172) -Fix-Commit: 744b63026a29f7eedbbc8e3a01a7f48a6eb0a085 (2.38-212) -Fix-Commit: fb22fd3f5b415dd4cd6f7b5741c2f0412374e242 (2.39-286) -Fix-Commit: bfc4dd9e526eacf3017dd8864ba0848e9d045dd4 (2.40-216) -Fix-Commit: 1e2c1ea4307197ccece0cda574bcfebf9080894c (2.41-121) -Fix-Commit: b0ec8fb689df862171f0f78994a3bdeb51313545 (2.42-49) -Reported-by: Igor Morgenstern, Aisle Research diff --git a/advisories/GLIBC-SA-2026-0002 b/advisories/GLIBC-SA-2026-0002 deleted file mode 100644 index f10d8362f6..0000000000 --- a/advisories/GLIBC-SA-2026-0002 +++ /dev/null @@ -1,36 +0,0 @@ -getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler - -Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend for networks and queries for a -zero-valued network in the GNU C Library version 2.0 to version 2.42 -can leak stack contents to the configured DNS resolver. - -A defect in the _nss_dns_getnetbyaddr_r function which implements -getnetbyaddr and getnetbyaddr_r in the dns-based network database can -pass stack contents unmodified to the configured DNS resolver as part of -the network DNS query when the network queried is the default network -i.e. net == 0x0. This stack contents leaking in the query is considered -a loss of confidentiality for the host making the query. Typically it -is rare to call these APIs with a net value of zero, and if an attacker -can control the net value it can only leak adjacent stack, and so loss -of confidentiality is spatially limited. The leak might be used to -accelerate an ASLR bypass by knowing pointer values, but also requires -network adjacent access to snoop between the application and the -DNS server; making the attack complexity higher. - -CVE-Id: CVE-2026-0915 -Public-Date: 2026-01-15 -Vulnerable-Commit: 5f0e6fc702296840d2daa39f83f6cb1e40073d58 (1.92-1) -Fix-Commit: e56ff82d5034ec66c6a78f517af6faa427f65b0b (2.43) -Fix-Commit: 453e6b8dbab935257eb0802b0c97bca6b67ba30e (2.42-50) -Fix-Commit: 15c9839a0b853f552b4ed9047841b6223f3c104d (2.41-122) -Fix-Commit: 329c775788b2c9ff3da774ccf59fba7b6b8ff08e (2.40-217) -Fix-Commit: 831f63b94ceb92fb14c0d1a7ddad35a0d1404c71 (2.39-287) -Fix-Commit: 49125ffc8e1674dc2a100dfdc5b78796f22e16f2 (2.38-213) -Fix-Commit: ddcaed5dfb05b2c1a6ea842fd6b643501365450a (2.37-173) -Fix-Commit: a6bf47887f24b2b394acb301a3189fda04bd4d4d (2.36-245) -Fix-Commit: 66f0cb057c9b4fb1249a5fec6ef4a63511a37899 (2.35-400) -Fix-Commit: 96863dee262225cfb79f9fe45e06fd188319c7b8 (2.34-526) -Fix-Commit: d210011f1536c8322157cbb4fe4229b35c834c08 (2.33-276) -Fix-Commit: 1bc1832cfc74c2a601220969f36e789a5e9f0ebe (2.32-152) -Reported-by: Igor Morgenstern, Aisle Research diff --git a/advisories/GLIBC-SA-2026-0003 b/advisories/GLIBC-SA-2026-0003 deleted file mode 100644 index b7a6e83a10..0000000000 --- a/advisories/GLIBC-SA-2026-0003 +++ /dev/null @@ -1,36 +0,0 @@ -wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory - -Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the -GNU C Library version 2.0 to version 2.42 may cause the interface to -return uninitialized memory in the we_wordv member, which on subsequent -calls to wordfree may abort the process. - -The implementation of WRDE_REUSE in conjunction with WRDE_APPEND fails -to clear the we_wordc member of the structure, and as such, when new -words are added internally, a leading we_wordc count number of entries -are skipped since they are assumed initialized. These skipped entries -are not initialized, but are the contents of a realloc-expanded array of -pointers. If the caller inspects the we_wordv array, it will -dereference invalid pointers and crash. If the caller calls wordfree, -the malloc implementation may detect the invalid pointers and abort the -process. Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never -worked correctly and thus the existence of applications that make use of -this feature is unlikely. - -CVE-Id: CVE-2025-15281 -Public-Date: 2026-01-20 -Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260) -Fix-Commit: 80cc58ea2de214f85b0a1d902a3b668ad2ecb302 (2.43) -Fix-Commit: cbf39c26b25801e9bc88499b4fd361ac172d4125 (2.42-51) -Fix-Commit: fb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 (2.41-123) -Fix-Commit: 9fe8576664d43b87ca19401fb6a975e217e47623 (2.40-218) -Fix-Commit: ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc (2.39-288) -Fix-Commit: d5409a1be010699794264162c551ba60f05ee6c3 (2.38-214) -Fix-Commit: ff2b172803f6bbd897755d2ce83ec4323a1a15b3 (2.37-174) -Fix-Commit: e97cfe2293ed097eb3d0b4c18274d22855e65130 (2.36-246) -Fix-Commit: bb59339d02faebac534a87eea50c83c948f35b77 (2.35-401) -Fix-Commit: 2b656ff94d72f93c84d8da2e7c76456c1994f02e (2.34-527) -Fix-Commit: 1d8ed2067a8a5d162a07670d0d063429679f17a0 (2.33-277) -Fix-Commit: 3a56c4ee4ea49b8f2391a2d8d6220013c4160a79 (2.32-153) -Fix-Commit: 28eb5caf895ced5d895cb02757e109004a2d33e5 (2.31-167) -Reported-by: Vitaly Simonovich diff --git a/advisories/GLIBC-SA-2026-0004 b/advisories/GLIBC-SA-2026-0004 deleted file mode 100644 index fd630dc591..0000000000 --- a/advisories/GLIBC-SA-2026-0004 +++ /dev/null @@ -1,30 +0,0 @@ -nscd client crash on x86_64 under high nscd load - -Calling NSS-backed functions that support caching via nscd may call the -nscd client side code and in the GNU C Library version 2.36 under high -load on x86_64 systems, the client may call memcmp on inputs that are -concurrently modified by other processes or threads and crash. - -The nscd client in the GNU C Library uses the memcmp function with -inputs that may be concurrently modified by another thread, potentially -resulting in spurious cache misses, which in itself is not a security -issue. However in the GNU C Library version 2.36 an optimized -implementation of memcmp was introduced for x86_64 which could crash -when invoked with such undefined behaviour, turning this into a -potential crash of the nscd client and the application that uses it. -This implementation was backported to the 2.35 branch, making the nscd -client in that branch vulnerable as well. Subsequently, the fix for -this issue was backported to all vulnerable branches in the GNU C -Library repository. - -It is advised that distributions that may have cherry-picked the memcpy -SSE2 optimization in their copy of the GNU C Library, also apply the fix -to avoid the potential crash in the nscd client. - -CVE-Id: CVE-2026-3904 -Public-Date: 2026-03-11 -Vulnerable-Commit: 8804157ad9da39631703b92315460808eac86b0c (2.36) -Vulnerable-Commit: 5a8df6485c584e2b0e957ec6b9070437a724911a (2.35-89) -Fix-Commit: b712be52645282c706a5faa038242504feb06db5 (2.37) -Fix-Commit: 93967a2a7bbdcedb73e0b246713580c7c84d001e (2.36-84) -Fix-Commit: 6bcd5d8e3668d52388a6e0580611749f93e6871f (2.35-230) diff --git a/advisories/GLIBC-SA-2026-0005 b/advisories/GLIBC-SA-2026-0005 deleted file mode 100644 index 7a50a43263..0000000000 --- a/advisories/GLIBC-SA-2026-0005 +++ /dev/null @@ -1,37 +0,0 @@ -gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response - -Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend in the GNU C Library version -2.34 to version 2.43 could, with a crafted response from the configured -DNS server, result in a violation of the DNS specification that causes -the application to treat a non-answer section of the DNS response as a -valid answer. - -A defect in the getanswer_ptr function, which implements the iteration -and extraction of the answer from the DNS response, can cause it to -incorrectly transition from the answer section to the next section while -still treating it as an answer to the question. This can happen when -the answer contains only skipped records, and the subsequent section -contains a semantically invalid T_PTR record. This is considered a -security issue because it is a violation of the DNS specification that -leads to incorrect behaviour that could result in the wrong hostname -being returned to the caller. At the time of publication, no known -affected DNS server returns results that would be incorrectly -interpreted by the library. An attacker would either need to be network -adjacent or have compromised the DNS server to use this defect to hide -returned reverse DNS results from intrusion detection systems. Even -then, the inbound connection from the attacker, or the outbound -connection from the application, would be visible to the intrusion -detection system. At best, the defect can be used to obfuscate and -delay analysis of the evolving threat. - -CVE-Id: CVE-2026-4437 -Public-Date: 2026-03-20 -Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) -Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) -Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) -Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) -Fix-Commit: 5c6fca0c62ce5bd6e68e259f138097756cbafd4d (2.43-16) -Fix-Commit: 9f5f18aab40ec6b61fa49a007615e6077e9a979b (2.44) -Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me -Reported-by: Kevin Farrell diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006 deleted file mode 100644 index 1ac70de4d9..0000000000 --- a/advisories/GLIBC-SA-2026-0006 +++ /dev/null @@ -1,27 +0,0 @@ -gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames - -Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf -that specifies the library's DNS backend in the GNU C library version -2.34 to version 2.43 could result in an invalid DNS hostname being -returned to the caller in violation of the DNS specification. - -A defect in the getanswer_ptr function, which implements the iteration -and extraction of the answer from a DNS response, can cause it to accept -an invalid DNS hostname that can contain shell metacharacters. An -application that uses the returned hostname in a shell, without guarding -for shell expansion, may be subject to shell injection attacks. At the -time of publication, no known affected DNS server returns results with -shell metacharacters in the results. An attacker would either need to -be network adjacent or have compromised the DNS server to use this -defect for shell injection. No known vulnerable application has been -identified. - -CVE-Id: CVE-2026-4438 -Public-Date: 2026-03-20 -Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) -Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) -Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) -Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) -Fix-Commit: dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718 (2.43-17) -Fix-Commit: e10977481f4db4b2a3ce34fa4c3a1e26651ae312 (2.44) -Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me diff --git a/advisories/GLIBC-SA-2026-0007 b/advisories/GLIBC-SA-2026-0007 deleted file mode 100644 index b880fb5544..0000000000 --- a/advisories/GLIBC-SA-2026-0007 +++ /dev/null @@ -1,15 +0,0 @@ -iconv crash due to assertion failure with untrusted input - -The iconv() function in the GNU C Library versions 2.43 and earlier may -crash due to an assertion failure when converting inputs from the -IBM1390 or IBM1399 character sets, which may be used to remotely crash -an application. - -This vulnerability can be trivially mitigated by removing the IBM1390 -and IBM1399 character sets from systems that do not need them. - -CVE-Id: CVE-2026-4046 -Public-Date: 2026-03-12 -Vulnerable-Commit: 0ecb606cb6cf65de1d9fc8a919bceb4be476c602 (2.3.3-1501) -Fix-Commit: d6f08d1cf027f4eb2ba289a6cc66853722d4badc (2.44) -Reported-by: Rocket Ma diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008 deleted file mode 100644 index 43b38ce38a..0000000000 --- a/advisories/GLIBC-SA-2026-0008 +++ /dev/null @@ -1,22 +0,0 @@ -REJECTED: Static buffer overflow in deprecated nis_local_principal - -REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been -discovered that no NIS+ client or server was ever released for any -Linux-based OS distributions and as such this makes the API provisional -and unused. Secondly it has been discovered that the NIS+ cold start -cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API -can only be called with a trusted server from the pre-populated cache. -The use of a trusted server means no trust boundary is crossed and this -is therefore considered a normal bug. - -NIS+ support in the GNU C Library was never officially supported even -though an incomplete implementation of the APIs was made pulibc. To the -best knowledge of the glibc security team no open-source NIS+ server -implementations were ever released for use with this API. Applications -should not use any of the NIS+ APIs and should move to modern identity -and access management services. - -CVE-Id: CVE-2026-5358 -Public-Date: 2026-04-10 -Rejected-Date: 2026-04-33 -Reported-by: Rahul Hoysala diff --git a/advisories/GLIBC-SA-2026-0009 b/advisories/GLIBC-SA-2026-0009 deleted file mode 100644 index 3c297fdc80..0000000000 --- a/advisories/GLIBC-SA-2026-0009 +++ /dev/null @@ -1,23 +0,0 @@ -scanf %mc off-by-one heap buffer overflow - -Calling the scanf family of functions with a %mc (malloc'd character -match) in the GNU C Library version 2.7 to version 2.43 with a format -width specifier with an explicit width greater than 1024 could result in -a one byte heap buffer overflow. - -The bug is in the buffer growth formula in __vfscanf_internal, which -under-allocates by one byte during realloc expansion, allowing a -controlled single-byte overwrite past the end of the heap buffer. - -The impact is limited by the fact that to execute the overwrite you need -both user controlled input data and a specific choice of maximum width -that yields a smaller than needed allocation. The latter point has to -take into account malloc's particular chunk size rounding process. The -"%[width]mc" format specifier does not appear to have notable use in -major Linux-based OS distributions, due to which the real world impact -may be limited to bespoke use cases. - -CVE-Id: CVE-2026-5450 -Public-Date: 2026-03-19 -Vulnerable-Commit: 874aa52349cc111d1f6ea5dff24bb14c306714e0 (2.7) -Reported-by: Rocket Ma diff --git a/advisories/GLIBC-SA-2026-0010 b/advisories/GLIBC-SA-2026-0010 deleted file mode 100644 index ae9953fb71..0000000000 --- a/advisories/GLIBC-SA-2026-0010 +++ /dev/null @@ -1,24 +0,0 @@ -Potential buffer under-read in ungetwc - -Calling the ungetwc function on a FILE stream with wide characters -encoded in a character set that has overlaps between its single byte and -multi-byte character encodings, in the GNU C Library version 2.43 or -earlier, may result in an attempt to read bytes before an allocated -buffer, potentially resulting in unintentional disclosure of neighboring -data in the heap, or a program crash. - -A bug in the wide character pushback implementation -(_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate -on the regular character buffer (fp->_IO_read_ptr) instead of the actual -wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program -crash may happen in cases where fp->_IO_read_ptr is not initialized and -hence points to NULL. The buffer under-read requires a special situation -where the input character encoding is such that there are overlaps -between single byte representations and multibyte representations in -that encoding, resulting in spurious matches. The spurious match case -is not possible in the standard Unicode character sets. - -CVE-Id: CVE-2026-5928 -Public-Date: 2026-03-17 -Reported-by: Rocket Ma -Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89) diff --git a/advisories/GLIBC-SA-2026-0011 b/advisories/GLIBC-SA-2026-0011 deleted file mode 100644 index e492fa5507..0000000000 --- a/advisories/GLIBC-SA-2026-0011 +++ /dev/null @@ -1,24 +0,0 @@ -Potential buffer overflow in ns_sprintrrf TSIG handling path - -The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the -GNU C Library version 2.2 and newer fail to enforce the caller-supplied -buffer length, and can result in an out-of-bounds write when printing -TSIG records. - -A defect in the TSIG case handling within ns_sprintrrf performs a -formatted write using sprintf without checking the remaining buffer -length, and may write up to 6 bytes past the end of the buffer. If the -library is compiled with assertions, and the out-of-bounds write doesn't -terminate the process, then a subsequent check for "len <= *buflen" will -trigger an assertion failure. - -These functions are for application debugging only and hence not in the -path of code executed by the DNS resolver. Further, they have been -deprecated since version 2.34 (2021-08-02) and should not be used by any -new applications. Applications should consider porting away from these -interfaces since they may be removed in future versions. - -CVE-Id: CVE-2026-5435 -Public-Date: 2026-04-02 -Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2) -Reported-by: shinobu diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012 deleted file mode 100644 index 22071d97a6..0000000000 --- a/advisories/GLIBC-SA-2026-0012 +++ /dev/null @@ -1,18 +0,0 @@ -Buffer overread in ns_printrrf with corrupted RDATA field - -The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the -GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA -content against the RDATA length in a DNS response when processing A6, -CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a -DNS response, causing a target application to crash or read -uninitialized memory. - -These functions are for application debugging only and hence not in the -path of code executed by the DNS resolver. Further, they have been -deprecated since version 2.34 and should not be used by any new -applications. Applications should consider porting away from these -interfaces since they may be removed in future versions. - -CVE-Id: CVE-2026-6238 -Public-Date: 2026-04-11 -Vulnerable-Commit: ee188d555b8c32ad9704a7440cab400af967292f (1.90) diff --git a/advisories/GLIBC-SA-2026-0013 b/advisories/GLIBC-SA-2026-0013 deleted file mode 100644 index 085a853434..0000000000 --- a/advisories/GLIBC-SA-2026-0013 +++ /dev/null @@ -1,20 +0,0 @@ -Potential stack-based buffer clash during tilde expansion in wordexp - -Calling wordexp with a tilde (~) followed by an overly long username -in the GNU C Library version 2.2.3 to 2.43 may lead to a stack buffer -clash. - -When expanding paths that begin with a tilde (~) followed by a username, the -internal parse_tilde function extracts the username to determine the user's -home directory. The implementation allocates memory for this username directly -on the stack using the strndupa macro. Because the size of this allocation -was determined by the length of the user-supplied input without any bounds -checks, passing an excessively long username e.g. thousands of characters, -forces the thread to exhaust its stack space. Thus if an application passes -untrusted, attacker-controlled input to the wordexp function, an attacker -can trigger a stack clash. - -CVE-Id: CVE-2026-6791 -Public-Date: 2026-06-22 -Vulnerable-Commit: 344af000e1d6e9c7882b9bc48e71cb3f1b5fc03c (2.2.3-114) -Reported-by: storm diff --git a/advisories/GLIBC-SA-2026-0014 b/advisories/GLIBC-SA-2026-0014 deleted file mode 100644 index 1e9a0039f0..0000000000 --- a/advisories/GLIBC-SA-2026-0014 +++ /dev/null @@ -1,19 +0,0 @@ -wordexp with WRDE_APPEND may result in an invalid call to free() - -Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion -(where an error like WRDE_BADCHAR would be returned) can create a stale -address in the wordexp_t that can cause an invalid free from wordfree. -This affects the GNU C Library version 2.0 to version 2.43. - -In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state -before appending the processing input. If the word expansion grows -we_wordv via realloc, and realloc requires moving we_wordv to a new memory -location (instead of expanding in-place), and the expansion later fails, -the rollback fails to properly restore all previous we_wordv values and -may add stale pointers into the caller-visible state. A subsequent -wordfree may then issue an invalid call to free(). - -CVE-Id: CVE-2026-6368 -Public-Date: 2026-07-14 -Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260) -Reported-by: shinobu diff --git a/advisories/README b/advisories/README deleted file mode 100644 index 330a31dff3..0000000000 --- a/advisories/README +++ /dev/null @@ -1,92 +0,0 @@ -GNU C Library Security Advisory Format -====================================== - -Security advisories in this directory follow a simple git commit log -format, with a heading and free-format description augmented with tags -to allow parsing key information. References to code changes are -specific to the glibc repository and follow a specific format: - - Tag-name: (release-version) - -The indicates a specific commit in the repository. The -release-version indicates the publicly consumable release in which this -commit is known to exist. The release-version is derived from the -git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and -is of the form 2.34-NNN. If the -NNN suffix is absent, it means that -the change is in that release tarball, otherwise the change is on the -release/2.YY/master branch and not in any released tarball. - -The following tags are currently being used: - -CVE-Id: -This is the CVE-Id assigned under the CVE Program -(https://www.cve.org/). - -Public-Date: -The date this issue became publicly known. - -Rejected-Date: -The most recent date the assigned advisory was rejected. If the advisory -is ever published again the Rejected-Date tag should be removed. - -Vulnerable-Commit: -The commit that introduced this vulnerability. There could be multiple -entries, one for each release branch in the glibc repository; the -release-version portion of this tag should tell you which branch this is -on. - -Fix-Commit: -The commit that fixed this vulnerability. There could be multiple -entries for each release branch in the glibc repository, indicating that -all of those commits contributed to fixing that issue in each of those -branches. - -Reported-By: -The entity that reported this issue. There could be multiple entries, one for -each reporter. - -Adding an Advisory ------------------- - -An advisory for a CVE needs to be added on the master branch in two steps: - -1. Add the text of the advisory without any Fix-Commit tags along with - the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. - The advisories directory does not exist in release branches, so keep - the advisory text commit distinct from the code changes, to ease - backports. Ask for the GLIBC-SA advisory number from the security - team. - -2. Finish all backports on release branches and then back on the msater - branch, add all commit refs to the advisory using the Fix-Commit - tags. Don't bother adding the release-version subscript since the - next step will overwrite it. - -3. Run the process-advisories.sh script in the scripts directory on the - advisory: - - scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN - - (replace YYYY-NNNN with the actual advisory number). - -4. Verify the updated advisory and push the result. - -Rejecting an Advisory ---------------------- - -Rejecting an advisory on the master branch can be done in one step: - -1. Mark the advisory as rejected. Add the text "REJECTED: " as a prefix - to any short-form description. Add a new paragraph that starts with - "REJECTED: " and explains the reason for the rejection including - justification for why it no longer has security impact. Lastly add - a Rejected-Date tag to the advisory. - -Getting a NEWS snippet from advisories --------------------------------------- - -Run: - - scripts/process-advisories.sh news - -and copy the content into the NEWS file. commit 1bd79651065b27c02c6502b9423124e54882058d Author: Andreas K. Hüttel Date: Sat Jul 25 09:21:33 2026 +0900 NEWS: start 2.44.1 section Signed-off-by: Andreas K. Hüttel diff --git a/NEWS b/NEWS index ee28fadf49..1043343d70 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,10 @@ See the end for copying conditions. Please send GNU C library bug reports via using `glibc' in the "product" field. +Version 2.44.1 + +The following bugs are resolved with this release: + Version 2.44 Major new features: commit 0b05bc142249ac47e72be5cad5c37f33f4bb68d4 Author: Samuel Thibault Date: Fri Jul 24 23:10:02 2026 +0200 hurd: Make the readlink __fstatat64 references optional They may show up or not depending on the toolchain in use. diff --git a/sysdeps/mach/hurd/i386/localplt.data b/sysdeps/mach/hurd/i386/localplt.data index 2befcd3748..5b9413422d 100644 --- a/sysdeps/mach/hurd/i386/localplt.data +++ b/sysdeps/mach/hurd/i386/localplt.data @@ -25,14 +25,14 @@ ld.so: __writev ld.so: __libc_lseek64 ld.so: __mmap ld.so: __fstat64 -ld.so: __fstatat64 +ld.so: __fstatat64 ? ld.so: __stat64 ld.so: __access ld.so: __getpid ld.so: __getcwd ld.so: _exit ? ld.so: abort -ld.so: readlink +ld.so: readlink ? ld.so: _hurd_intr_rpc_mach_msg ld.so: __errno_location ld.so: _dl_init_first diff --git a/sysdeps/mach/hurd/x86_64/localplt.data b/sysdeps/mach/hurd/x86_64/localplt.data index fda28cd983..cc39118d12 100644 --- a/sysdeps/mach/hurd/x86_64/localplt.data +++ b/sysdeps/mach/hurd/x86_64/localplt.data @@ -24,14 +24,14 @@ ld.so: __writev ld.so: __libc_lseek64 ld.so: __mmap ld.so: __fstat64 -ld.so: __fstatat64 +ld.so: __fstatat64 ? ld.so: __stat64 ld.so: __access ld.so: __getpid ld.so: __getcwd ld.so: _exit ? ld.so: abort -ld.so: readlink +ld.so: readlink ? ld.so: _hurd_intr_rpc_mach_msg ld.so: __errno_location ld.so: _dl_init_first commit c045fc61e8435c103ebfe06d01fec7f56503e2b4 Author: Samuel Thibault Date: Mon Jul 27 00:59:36 2026 +0200 hurd: fix fork's longjmp demangling on i386 i386's setjmp does not actually mangle ebp. diff --git a/sysdeps/mach/hurd/i386/longjmp-ts.c b/sysdeps/mach/hurd/i386/longjmp-ts.c index 93450e86b4..340104b832 100644 --- a/sysdeps/mach/hurd/i386/longjmp-ts.c +++ b/sysdeps/mach/hurd/i386/longjmp-ts.c @@ -38,7 +38,6 @@ _hurd_longjmp_thread_state (void *state, jmp_buf env, int val) ts->eip = env[0].__jmpbuf[JB_PC]; ts->eax = val ?: 1; - PTR_DEMANGLE (ts->ebp); PTR_DEMANGLE (ts->uesp); PTR_DEMANGLE (ts->eip); } commit 7cba77790f3279bec3ac20e9c7632b021cd53f95 Author: Adhemerval Zanella Date: Mon Jul 27 13:37:19 2026 -0300 math: Fix sinh worst-case results for |x| > 36.736801 [BZ 34441] The CORE-MATH import mistranslated the accurate path result scaling 'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed68), and two of the 51 exceptional-case table entries were dropped when the table was moved to e_sinh_data.c (commit f05c4907a27). Checked on x86_64-linux-gnu and aarch64-linux-gnu. (cherry picked from commit fdc90dbb52b092f68cd5a4fac7a4cbd854c91bc3) diff --git a/NEWS b/NEWS index 1043343d70..fe2b1d7f79 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,9 @@ using `glibc' in the "product" field. Version 2.44.1 The following bugs are resolved with this release: + + [34441] math: math: sinh() returns wrong results for some inputs with + |x| > 36.736801 Version 2.44 diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in index ca670768a2..5c4d486af4 100644 --- a/math/auto-libm-test-in +++ b/math/auto-libm-test-in @@ -9661,6 +9661,14 @@ sinh 0x2.c5d37700c6bb03a6c24b6c9b494cp+12 sinh 0x2.c5d37700c6bb03a6c24b6c9b494ep+12 # the next value generates larger error bounds on x86_64 (binary64) sinh -0x1.633c62890fa14p+9 +sinh 0x1.2b4f4e0bb49c9p+5 +sinh -0x1.2b4f4e0bb49c9p+5 +sinh 0x1.2ac43fb6d3abap+5 +sinh -0x1.2ac43fb6d3abap+5 +sinh 0x1.b7efa91915c95p-2 +sinh -0x1.b7efa91915c95p-2 +sinh 0x1.92a5c27afbe82p+4 +sinh -0x1.92a5c27afbe82p+4 sinpi 0 sinpi -0 diff --git a/math/auto-libm-test-out-sinh b/math/auto-libm-test-out-sinh index f96252b91c..91ab5c19fa 100644 --- a/math/auto-libm-test-out-sinh +++ b/math/auto-libm-test-out-sinh @@ -6466,3 +6466,555 @@ sinh -0x1.633c62890fa14p+9 = sinh tonearest ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok = sinh towardzero ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok = sinh upward ibm128 -0x2.c678c5121f428p+8 : -0xf.ef3a7e711d2c75a66ea3ca1c4p+1020 : inexact-ok +sinh 0x1.2b4f4e0bb49c9p+5 += sinh downward binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh tonearest binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh towardzero binary32 0x2.569eap+4 : 0x1.f7c30ap+52 : inexact-ok += sinh upward binary32 0x2.569eap+4 : 0x1.f7c30cp+52 : inexact-ok += sinh downward binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok += sinh tonearest binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok += sinh towardzero binary64 0x2.569eap+4 : 0x1.f7c30a155eea3p+52 : inexact-ok += sinh upward binary64 0x2.569eap+4 : 0x1.f7c30a155eea4p+52 : inexact-ok += sinh downward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh tonearest intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward intel96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh downward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh tonearest m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward m68k96 0x2.569eap+4 : 0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh downward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh tonearest binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh towardzero binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh upward binary128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok += sinh downward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh tonearest ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh towardzero ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh upward ibm128 0x2.569eap+4 : 0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh downward binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh tonearest binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh towardzero binary32 0x2.569e9cp+4 : 0x1.f7c28cp+52 : inexact-ok += sinh upward binary32 0x2.569e9cp+4 : 0x1.f7c28ep+52 : inexact-ok += sinh downward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok += sinh tonearest binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok += sinh towardzero binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac22fp+52 : inexact-ok += sinh upward binary64 0x2.569e9cp+4 : 0x1.f7c28c24ac23p+52 : inexact-ok += sinh downward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh tonearest intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward intel96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh downward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh tonearest m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward m68k96 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh downward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh tonearest binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh towardzero binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh upward binary128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok += sinh downward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh tonearest ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh towardzero ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh upward ibm128 0x2.569e9cp+4 : 0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh downward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh tonearest binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh towardzero binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh upward binary64 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh downward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh tonearest intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward intel96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh downward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh tonearest m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward m68k96 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh downward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh tonearest binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh towardzero binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh upward binary128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh downward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh tonearest ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh towardzero ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh upward ibm128 0x2.569e9c1769392p+4 : 0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok +sinh -0x1.2b4f4e0bb49c9p+5 += sinh downward binary32 -0x2.569e9cp+4 : -0x1.f7c28ep+52 : inexact-ok += sinh tonearest binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh towardzero binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh upward binary32 -0x2.569e9cp+4 : -0x1.f7c28cp+52 : inexact-ok += sinh downward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok += sinh tonearest binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac23p+52 : inexact-ok += sinh towardzero binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok += sinh upward binary64 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fp+52 : inexact-ok += sinh downward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh tonearest intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward intel96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh downward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbcp+52 : inexact-ok += sinh tonearest m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh towardzero m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh upward m68k96 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbep+52 : inexact-ok += sinh downward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ecp+52 : inexact-ok += sinh tonearest binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh towardzero binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh upward binary128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd1ebp+52 : inexact-ok += sinh downward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd2p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh upward ibm128 -0x2.569e9cp+4 : -0x1.f7c28c24ac22fbbe1ad8f17fd18p+52 : inexact-ok += sinh downward binary32 -0x2.569eap+4 : -0x1.f7c30cp+52 : inexact-ok += sinh tonearest binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh towardzero binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh upward binary32 -0x2.569eap+4 : -0x1.f7c30ap+52 : inexact-ok += sinh downward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok += sinh tonearest binary64 -0x2.569eap+4 : -0x1.f7c30a155eea4p+52 : inexact-ok += sinh towardzero binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok += sinh upward binary64 -0x2.569eap+4 : -0x1.f7c30a155eea3p+52 : inexact-ok += sinh downward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh tonearest intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward intel96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh downward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh tonearest m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c78p+52 : inexact-ok += sinh towardzero m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh upward m68k96 -0x2.569eap+4 : -0x1.f7c30a155eea3c76p+52 : inexact-ok += sinh downward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f53p+52 : inexact-ok += sinh tonearest binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh towardzero binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh upward binary128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f52p+52 : inexact-ok += sinh downward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84f8p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh upward ibm128 -0x2.569eap+4 : -0x1.f7c30a155eea3c77d646a5f84fp+52 : inexact-ok += sinh downward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh tonearest binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1ep+52 : inexact-ok += sinh towardzero binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh upward binary64 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1dp+52 : inexact-ok += sinh downward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh tonearest intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward intel96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh downward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d802p+52 : inexact-ok += sinh tonearest m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh towardzero m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh upward m68k96 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d8p+52 : inexact-ok += sinh downward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh tonearest binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f85p+52 : inexact-ok += sinh towardzero binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh upward binary128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f84p+52 : inexact-ok += sinh downward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000009p+52 : inexact-ok += sinh tonearest ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh towardzero ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok += sinh upward ibm128 -0x2.569e9c1769392p+4 : -0x1.f7c28f05c4c1d800000000008f8p+52 : inexact-ok +sinh 0x1.2ac43fb6d3abap+5 += sinh downward binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh tonearest binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh towardzero binary32 0x2.55888p+4 : 0x1.d6b0ecp+52 : inexact-ok += sinh upward binary32 0x2.55888p+4 : 0x1.d6b0eep+52 : inexact-ok += sinh downward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh tonearest binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh towardzero binary64 0x2.55888p+4 : 0x1.d6b0ecda100c2p+52 : inexact-ok += sinh upward binary64 0x2.55888p+4 : 0x1.d6b0ecda100c3p+52 : inexact-ok += sinh downward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh tonearest intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero intel96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward intel96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok += sinh downward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh tonearest m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward m68k96 0x2.55888p+4 : 0x1.d6b0ecda100c254p+52 : inexact-ok += sinh downward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh tonearest binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh towardzero binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh upward binary128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok += sinh downward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh tonearest ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh towardzero ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh upward ibm128 0x2.55888p+4 : 0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh downward binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok += sinh tonearest binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok += sinh towardzero binary32 0x2.55887cp+4 : 0x1.d6b076p+52 : inexact-ok += sinh upward binary32 0x2.55887cp+4 : 0x1.d6b078p+52 : inexact-ok += sinh downward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh tonearest binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh towardzero binary64 0x2.55887cp+4 : 0x1.d6b0772de38b2p+52 : inexact-ok += sinh upward binary64 0x2.55887cp+4 : 0x1.d6b0772de38b3p+52 : inexact-ok += sinh downward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh tonearest intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero intel96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward intel96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok += sinh downward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh tonearest m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward m68k96 0x2.55887cp+4 : 0x1.d6b0772de38b276ap+52 : inexact-ok += sinh downward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh tonearest binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh towardzero binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh upward binary128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok += sinh downward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh tonearest ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh towardzero ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh upward ibm128 0x2.55887cp+4 : 0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh downward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh tonearest binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh upward binary64 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh tonearest intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward intel96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh tonearest m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward m68k96 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh downward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh tonearest binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh towardzero binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh upward binary128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok += sinh downward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh tonearest ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh towardzero ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh upward ibm128 0x2.55887f6da7574p+4 : 0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok +sinh -0x1.2ac43fb6d3abap+5 += sinh downward binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok += sinh tonearest binary32 -0x2.55887cp+4 : -0x1.d6b078p+52 : inexact-ok += sinh towardzero binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok += sinh upward binary32 -0x2.55887cp+4 : -0x1.d6b076p+52 : inexact-ok += sinh downward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b3p+52 : inexact-ok += sinh tonearest binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh towardzero binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh upward binary64 -0x2.55887cp+4 : -0x1.d6b0772de38b2p+52 : inexact-ok += sinh downward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok += sinh tonearest intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward intel96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh downward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b276ap+52 : inexact-ok += sinh tonearest m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh towardzero m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh upward m68k96 -0x2.55887cp+4 : -0x1.d6b0772de38b2768p+52 : inexact-ok += sinh downward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c262p+52 : inexact-ok += sinh tonearest binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh towardzero binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh upward binary128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c261p+52 : inexact-ok += sinh downward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c28p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh upward ibm128 -0x2.55887cp+4 : -0x1.d6b0772de38b2768d785fab9c2p+52 : inexact-ok += sinh downward binary32 -0x2.55888p+4 : -0x1.d6b0eep+52 : inexact-ok += sinh tonearest binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh towardzero binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh upward binary32 -0x2.55888p+4 : -0x1.d6b0ecp+52 : inexact-ok += sinh downward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c3p+52 : inexact-ok += sinh tonearest binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh towardzero binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh upward binary64 -0x2.55888p+4 : -0x1.d6b0ecda100c2p+52 : inexact-ok += sinh downward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok += sinh tonearest intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward intel96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh downward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c254p+52 : inexact-ok += sinh tonearest m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh towardzero m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh upward m68k96 -0x2.55888p+4 : -0x1.d6b0ecda100c253ep+52 : inexact-ok += sinh downward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d9p+52 : inexact-ok += sinh tonearest binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh towardzero binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh upward binary128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed6d8p+52 : inexact-ok += sinh downward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed7p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh upward ibm128 -0x2.55888p+4 : -0x1.d6b0ecda100c253edb8a451ed68p+52 : inexact-ok += sinh downward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh upward binary64 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65p+52 : inexact-ok += sinh downward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward intel96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh downward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh tonearest m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b66p+52 : inexact-ok += sinh towardzero m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh upward m68k96 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65ffep+52 : inexact-ok += sinh downward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289fp+52 : inexact-ok += sinh tonearest binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh towardzero binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh upward binary128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff289ep+52 : inexact-ok += sinh downward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff29p+52 : inexact-ok += sinh tonearest ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh towardzero ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok += sinh upward ibm128 -0x2.55887f6da7574p+4 : -0x1.d6b0dc08d1b65fffffffffff288p+52 : inexact-ok +sinh 0x1.b7efa91915c95p-2 += sinh downward binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh tonearest binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh towardzero binary32 0x6.dfbea8p-4 : 0x7.1661a8p-4 : inexact-ok += sinh upward binary32 0x6.dfbea8p-4 : 0x7.1661bp-4 : inexact-ok += sinh downward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok += sinh towardzero binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e4p-4 : inexact-ok += sinh upward binary64 0x6.dfbea8p-4 : 0x7.1661abb8260e8p-4 : inexact-ok += sinh downward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward intel96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok += sinh downward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward m68k96 0x6.dfbea8p-4 : 0x7.1661abb8260e76bp-4 : inexact-ok += sinh downward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh upward binary128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh downward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh upward ibm128 0x6.dfbea8p-4 : 0x7.1661abb8260e76a92049555ecp-4 : inexact-ok += sinh downward binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh tonearest binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh towardzero binary32 0x6.dfbeap-4 : 0x7.1661ap-4 : inexact-ok += sinh upward binary32 0x6.dfbeap-4 : 0x7.1661a8p-4 : inexact-ok += sinh downward binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok += sinh towardzero binary64 0x6.dfbeap-4 : 0x7.1661a2f837414p-4 : inexact-ok += sinh upward binary64 0x6.dfbeap-4 : 0x7.1661a2f837418p-4 : inexact-ok += sinh downward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward intel96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok += sinh downward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward m68k96 0x6.dfbeap-4 : 0x7.1661a2f837416e98p-4 : inexact-ok += sinh downward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh upward binary128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok += sinh downward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh upward ibm128 0x6.dfbeap-4 : 0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok += sinh downward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok += sinh tonearest binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed208p-4 : inexact-ok += sinh upward binary64 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh tonearest intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward intel96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh tonearest m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward m68k96 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20cp-4 : inexact-ok += sinh downward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh tonearest binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh towardzero binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh upward binary128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh downward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh tonearest ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh towardzero ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh upward ibm128 0x6.dfbea46457254p-4 : 0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok +sinh -0x1.b7efa91915c95p-2 += sinh downward binary32 -0x6.dfbeap-4 : -0x7.1661a8p-4 : inexact-ok += sinh tonearest binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh towardzero binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh upward binary32 -0x6.dfbeap-4 : -0x7.1661ap-4 : inexact-ok += sinh downward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbeap-4 : -0x7.1661a2f837418p-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok += sinh upward binary64 -0x6.dfbeap-4 : -0x7.1661a2f837414p-4 : inexact-ok += sinh downward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward intel96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e98p-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbeap-4 : -0x7.1661a2f837416e9p-4 : inexact-ok += sinh downward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4ccp-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh upward binary128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4c8p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d6p-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh upward ibm128 -0x6.dfbeap-4 : -0x7.1661a2f837416e909121ab55d4p-4 : inexact-ok += sinh downward binary32 -0x6.dfbea8p-4 : -0x7.1661bp-4 : inexact-ok += sinh tonearest binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh towardzero binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh upward binary32 -0x6.dfbea8p-4 : -0x7.1661a8p-4 : inexact-ok += sinh downward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e8p-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok += sinh upward binary64 -0x6.dfbea8p-4 : -0x7.1661abb8260e4p-4 : inexact-ok += sinh downward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward intel96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76bp-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a8p-4 : inexact-ok += sinh downward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed8p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh upward binary128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebed4p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ecp-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh upward ibm128 -0x6.dfbea8p-4 : -0x7.1661abb8260e76a92049555ebep-4 : inexact-ok += sinh downward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok += sinh upward binary64 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed208p-4 : inexact-ok += sinh downward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward intel96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh downward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh tonearest m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20cp-4 : inexact-ok += sinh towardzero m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh upward m68k96 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bff8p-4 : inexact-ok += sinh downward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh tonearest binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb48p-4 : inexact-ok += sinh towardzero binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh upward binary128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeb44p-4 : inexact-ok += sinh downward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh tonearest ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffecp-4 : inexact-ok += sinh towardzero ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok += sinh upward ibm128 -0x6.dfbea46457254p-4 : -0x7.1661a7c5ed20bfffffffffffeap-4 : inexact-ok +sinh 0x1.92a5c27afbe82p+4 += sinh downward binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok += sinh tonearest binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok += sinh towardzero binary32 0x1.92a5c4p+4 : 0x9.e410bp+32 : inexact-ok += sinh upward binary32 0x1.92a5c4p+4 : 0x9.e410cp+32 : inexact-ok += sinh downward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c85p+32 : inexact-ok += sinh upward binary64 0x1.92a5c4p+4 : 0x9.e410bd8d8c858p+32 : inexact-ok += sinh downward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward intel96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh downward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward m68k96 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh downward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh upward binary128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c4p+4 : 0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok += sinh downward binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh tonearest binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh towardzero binary32 0x1.92a5c2p+4 : 0x9.e40f8p+32 : inexact-ok += sinh upward binary32 0x1.92a5c2p+4 : 0x9.e40f9p+32 : inexact-ok += sinh downward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c2p+4 : 0x9.e40f810b889bp+32 : inexact-ok += sinh upward binary64 0x1.92a5c2p+4 : 0x9.e40f810b889b8p+32 : inexact-ok += sinh downward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward intel96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh downward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward m68k96 0x1.92a5c2p+4 : 0x9.e40f810b889b76cp+32 : inexact-ok += sinh downward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh upward binary128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c2p+4 : 0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok += sinh downward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward binary64 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392ap+32 : inexact-ok += sinh downward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward intel96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok += sinh downward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh tonearest m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298p+32 : inexact-ok += sinh upward m68k96 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929801p+32 : inexact-ok += sinh downward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh tonearest binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh towardzero binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh upward binary128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh downward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh tonearest ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh towardzero ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh upward ibm128 0x1.92a5c27afbe82p+4 : 0x9.e40fcd12392980000000000024p+32 : inexact-ok +sinh -0x1.92a5c27afbe82p+4 += sinh downward binary32 -0x1.92a5c2p+4 : -0x9.e40f9p+32 : inexact-ok += sinh tonearest binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh towardzero binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh upward binary32 -0x1.92a5c2p+4 : -0x9.e40f8p+32 : inexact-ok += sinh downward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889b8p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok += sinh upward binary64 -0x1.92a5c2p+4 : -0x9.e40f810b889bp+32 : inexact-ok += sinh downward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward intel96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76cp+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bp+32 : inexact-ok += sinh downward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa468p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa46p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa8p+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c2p+4 : -0x9.e40f810b889b76bfa9a8c69fa4p+32 : inexact-ok += sinh downward binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok += sinh tonearest binary32 -0x1.92a5c4p+4 : -0x9.e410cp+32 : inexact-ok += sinh towardzero binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok += sinh upward binary32 -0x1.92a5c4p+4 : -0x9.e410bp+32 : inexact-ok += sinh downward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c858p+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh upward binary64 -0x1.92a5c4p+4 : -0x9.e410bd8d8c85p+32 : inexact-ok += sinh downward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward intel96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507bp+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507ap+32 : inexact-ok += sinh downward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e858p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e85p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60ecp+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c4p+4 : -0x9.e410bd8d8c8507a830e34d60e8p+32 : inexact-ok += sinh downward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392ap+32 : inexact-ok += sinh tonearest binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward binary64 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok += sinh tonearest intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward intel96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929801p+32 : inexact-ok += sinh tonearest m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh towardzero m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh upward m68k96 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298p+32 : inexact-ok += sinh downward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh tonearest binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd123929800000000000212p+32 : inexact-ok += sinh towardzero binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh upward binary128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002118p+32 : inexact-ok += sinh downward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd12392980000000000024p+32 : inexact-ok += sinh tonearest ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh towardzero ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok += sinh upward ibm128 -0x1.92a5c27afbe82p+4 : -0x9.e40fcd1239298000000000002p+32 : inexact-ok diff --git a/sysdeps/ieee754/dbl-64/e_sinh.c b/sysdeps/ieee754/dbl-64/e_sinh.c index 1643f3f504..638e3d6a6d 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh.c +++ b/sysdeps/ieee754/dbl-64/e_sinh.c @@ -213,7 +213,7 @@ __sinh (double x) ml = (ul + 8) & MANTISSA_MASK; th += tl; th *= 2; - th *= asuint64 (sp); + th *= sp; if (ml <= 16 || eh - el > 103) return as_sinh_database (x, th); return th; diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.c b/sysdeps/ieee754/dbl-64/e_sinh_data.c index ca61e311f1..d4fd41d934 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh_data.c +++ b/sysdeps/ieee754/dbl-64/e_sinh_data.c @@ -35,12 +35,13 @@ const double __sinh_data_ch[][2] = { 0x1.ae64567f54482p-26, -0x1.defcf17a6ab79p-81 } }; -const double __sinh_data_db[49][3] = +const double __sinh_data_db[51][3] = { { 0x1.364303e1ad8f6p-2, 0x1.3b07e0c779ddap-2, -0x1.bcp-106 }, { 0x1.4169f234f23b9p-2, 0x1.46b7b3b358f99p-2, -0x1p-56 }, { 0x1.616cc75d49226p-2, 0x1.687bd068c1c1ep-2, 0x1.ap-111 }, { 0x1.ae3773250e7d2p-2, 0x1.bafc3479fc9ccp-2, -0x1p-105 }, + { 0x1.b7efa91915c95p-2, 0x1.c59869f17b483p-2, -0x1p-104 }, { 0x1.d68039861ab53p-2, 0x1.e73b46abb01e1p-2, -0x1.2p-109 }, { 0x1.e90f16eb88c09p-2, 0x1.fbdd4a37760b7p-2, -0x1.f8p-108 }, { 0x1.a3fc7e4dd47d1p-1, 0x1.d4b21ebf542fp-1, 0x1.ep-107 }, @@ -62,6 +63,7 @@ const double __sinh_data_db[49][3] = { 0x1.43a81752eabe7p+3, 0x1.81d364845ecfap+13, -0x1p-90 }, { 0x1.16369cd53bb69p+4, 0x1.0fbc6c02b1c9p+24, -0x1.9p-81 }, { 0x1.20e29ea8b51e2p+4, 0x1.08b8abba28abcp+25, 0x1.9bp-79 }, + { 0x1.92a5c27afbe82p+4, 0x1.3c81f9a247253p+35, 0x1p-67 }, { 0x1.a1e4f11b513d7p+4, 0x1.9a65b6c2e2185p+36, -0x1.bcp-70 }, { 0x1.c089fcf166171p+4, 0x1.5c452e0e37569p+39, 0x1.4p-69 }, { 0x1.e42a98b3a0be5p+4, 0x1.938768ca4f8aap+42, 0x1.6dp-62 }, diff --git a/sysdeps/ieee754/dbl-64/e_sinh_data.h b/sysdeps/ieee754/dbl-64/e_sinh_data.h index 16f7e0da5a..c34848fd54 100644 --- a/sysdeps/ieee754/dbl-64/e_sinh_data.h +++ b/sysdeps/ieee754/dbl-64/e_sinh_data.h @@ -29,7 +29,7 @@ SOFTWARE. extern const double __sinh_data_ch[][2] attribute_hidden; #define CH __sinh_data_ch -extern const double __sinh_data_db[49][3] attribute_hidden; +extern const double __sinh_data_db[51][3] attribute_hidden; #define DB __sinh_data_db #endif commit 0b58f5d80d24cf83cfde9d8381aafb11fef0e152 Author: Adhemerval Zanella Date: Thu Jul 30 08:55:54 2026 -0300 math: Fix x86_64 tanh _FloatN aliases binding to the FMA variant [BZ 34465] The generic implementation emits libm_alias_double unconditionally, so tanhf32x and tanhf64 bind directly to __tanh_fma. Guard the alias with '#ifndef __tanh' and emit it from the dispatcher, as sin. Also remove the stale __expm1 defines, unused since tanh moved to CORE-MATH. Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'. Reported-by: Michael Brunnbauer (cherry picked from commit b01abba04a954cbd6b2834c0643a08685a915fe5) diff --git a/NEWS b/NEWS index fe2b1d7f79..43667c1963 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ The following bugs are resolved with this release: [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 + [34465] math: math: x86_64 tanh ifunc selection wrong Version 2.44 diff --git a/sysdeps/ieee754/dbl-64/s_tanh.c b/sysdeps/ieee754/dbl-64/s_tanh.c index 2029de8fa5..ef80b9edb6 100644 --- a/sysdeps/ieee754/dbl-64/s_tanh.c +++ b/sysdeps/ieee754/dbl-64/s_tanh.c @@ -283,4 +283,6 @@ __tanh (double x) return as_tanh_database (x, res); return res; } +#ifndef __tanh libm_alias_double (__tanh, tanh) +#endif diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c index 1b808b1227..1e6b33740a 100644 --- a/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c +++ b/sysdeps/x86_64/fpu/multiarch/s_tanh-fma.c @@ -1,10 +1,4 @@ #define __tanh __tanh_fma -#define __expm1 __expm1_fma - -/* NB: __expm1 may be expanded to __expm1_fma in the following - prototypes. */ -extern long double __expm1l (long double); -extern long double __expm1f128 (long double); #define SECTION __attribute__ ((section (".text.fma"))) diff --git a/sysdeps/x86_64/fpu/multiarch/s_tanh.c b/sysdeps/x86_64/fpu/multiarch/s_tanh.c index ec8826f634..9048c977c1 100644 --- a/sysdeps/x86_64/fpu/multiarch/s_tanh.c +++ b/sysdeps/x86_64/fpu/multiarch/s_tanh.c @@ -25,10 +25,9 @@ extern double __redirect_tanh (double); # define SYMBOL_NAME tanh # include "ifunc-fma.h" -libc_ifunc_redirected (__redirect_tanh, tanh, IFUNC_SELECTOR ()); +libc_ifunc_redirected (__redirect_tanh, __tanh, IFUNC_SELECTOR ()); +libm_alias_double (__tanh, tanh) # define __tanh __tanh_sse2 -# undef libm_alias_double -# define libm_alias_double(a, b) #endif #include commit 9bcb85688e58847191deb42bfc68d60802078df4 Author: Xi Ruoyao Date: Wed Jul 22 19:26:10 2026 +0800 io: fix ftw ABI on MIPS n64 On MIPS n64 off_t is same as off64_t, but struct stat is not same as struct stat64 (very peculiar but see the "as tempting as it..." comment in linux/mips/kernel_stat.h). As the ftw/ftw64 callback accepts a pointer to a function who accepts struct stat/stat64, for MIPS n64 we must use different implementations for ftw and ftw64. Thus for testing if ftw64 can be aliased to ftw, we should check XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T. This resolves the io/tst-ftw-lnk failure observed on MIPS n64. Link: https://sourceware.org/glibc/wiki/Testing/Tests/io/tst-ftw-lnk Signed-off-by: Xi Ruoyao Reviewed-by: Adhemerval Zanella (cherry picked from commit 6758def717175e679cb49b5051b6b5ec54ddfb2c) diff --git a/io/ftw.c b/io/ftw.c index ed0eeb3904..a9368a706e 100644 --- a/io/ftw.c +++ b/io/ftw.c @@ -18,7 +18,9 @@ #include -#ifndef __OFF_T_MATCHES_OFF64_T +#include + +#if !XSTAT_IS_XSTAT64 # include "ftw-common.c" versioned_symbol (libc, __new_nftw, nftw, GLIBC_2_3_3); diff --git a/io/ftw64.c b/io/ftw64.c index d3cd14c21a..fa7b05df22 100644 --- a/io/ftw64.c +++ b/io/ftw64.c @@ -31,6 +31,9 @@ #define ftw __rename_ftw #define nftw __rename_nftw +#include + +#include #include #include "ftw-common.c" @@ -44,7 +47,7 @@ versioned_symbol (libc, __new_nftw64, nftw64, GLIBC_2_3_3); compat_symbol (libc, __old_nftw64, nftw64, GLIBC_2_1); #endif -#ifdef __OFF_T_MATCHES_OFF64_T +#if XSTAT_IS_XSTAT64 weak_alias (__ftw64, ftw) versioned_symbol (libc, __new_nftw64, nftw, GLIBC_2_3_3); # if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_3_3) commit 58da792d8a2d8f2fe711318836e853fcddfd7cd8 Author: Adhemerval Zanella Date: Tue Aug 4 14:25:48 2026 +0000 hurd: Fix build after the ftw kernel_stat.h inclusion Commit 6758def7171 changed the generic ftw{64}.c to include kernel_stat.h, which is Linux specific. Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0, since struct stat and struct stat64 never share a layout on Hurd: on 32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and on 64-bit ABIs the two structures still differ in size because _SPARE_SIZE in bits/stat.h reserves three more ints of spare space in struct stat than in struct stat64. This keeps the ftw/ftw64 symbols exactly as before the change, where the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because the Hurd bits/typesizes.h does not define it. Checked with a full build for i686-gnu and x86_64-gnu. (cherry picked from commit d6031665c3a59faf75cf6bc55e041611da21d0e6) diff --git a/sysdeps/mach/hurd/kernel_stat.h b/sysdeps/mach/hurd/kernel_stat.h new file mode 100644 index 0000000000..aa8c26b1d9 --- /dev/null +++ b/sysdeps/mach/hurd/kernel_stat.h @@ -0,0 +1,23 @@ +/* Internal definitions for stat functions. Hurd version. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* struct stat and struct stat64 never have the same layout: on 32-bit + ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and + on 64-bit ABIs the two structures still differ in the amount of + trailing spare space (see _SPARE_SIZE in bits/stat.h). */ +#define XSTAT_IS_XSTAT64 0 commit fec2a9c6765b548f9d738e3a1c63a63ad7061d40 Author: Adhemerval Zanella Date: Fri Mar 21 14:03:00 2025 +0000 linux: Inline syscall cancellation to keep wrapper frames observable (BZ 34338) The cancellable syscall wrappers end with a tail call to __syscall_cancel, the wrapper frame is then elided, so when the syscall executes the wrapper is no longer present on the stack. Tools that unwind from CFI alone, such as valgrind, perf and sampling profilers, cannot observe it. On gdb, it only recovers it from DWARF call site information, which reduced-debuginfo libc builds usually omit. The behaviour is target dependent: for a shared (PIC) the tail call is emitted on aarch64, arc, loongarch and riscv. It is not emitted on i386, x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed on the stack or fewer argument registers are available, nor on powerpc and mips, where the TOC/GOT pointer must be restored after the call. This is why the problem was originally reported as aarch64 specific while x86_64 was unaffected. Rather than only inhibiting the tail call [1] (which keeps the wrapper frame but still leaves the __syscall_cancel and __internal_syscall_cancel frames), move the cancellation logic back into the wrappers. In the single-threaded case the syscall is now issued directly from the wrapper; only the multi-threaded path still calls the out-of-line __syscall_cancel_arch. This keeps the wrapper observable and removes the extra frames, mimicking how cancellation was handled before 89b53077d2a58f00e7debdfe58afabe953dac60d. The result is a small libc.so .text increase (size, first column): ABI master patched diff increase aarch64 1635880 1647424 11544 0.71% x86_64 1981081 1992257 11176 0.56% powerpc64le 2364336 2376964 12628 0.53% riscv64 1368386 1376704 8318 0.61% loongarch64 1741385 1755601 14216 0.82% The tst-backtrace5 was suppose to track this issue, but due wrong loop variable check it does not take this in account. This patch also fixes it. Checked on aarch64-linux-gnu, x86_64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, and powerpc64le-linux-gnu. [1] https://sourceware.org/pipermail/libc-alpha/2025-March/165395.html (cherry picked from commit 1b5ff009fa5bf01ad26e6cc330a1df5a0c84135e) diff --git a/NEWS b/NEWS index 43667c1963..28fbd9bcd8 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,8 @@ Version 2.44.1 The following bugs are resolved with this release: + [34338] libc: Cancellable syscall wrappers are missing from backtraces + because they tail-call __syscall_cancel [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong diff --git a/debug/tst-backtrace5.c b/debug/tst-backtrace5.c index 4c5784c060..6538da9ab5 100644 --- a/debug/tst-backtrace5.c +++ b/debug/tst-backtrace5.c @@ -36,10 +36,15 @@ trampoline, read, 3 * fn, and do_test. */ #define NUM_FUNCTIONS 7 +/* Avoid the read wrapper frame truncation on targets that add extra frames + between it and handle_signal (the cancellable syscall wrappers + __syscall_cancel*, or the i686 __kernel_vsyscall entry). */ +#define MAX_FUNCTIONS 64 + void handle_signal (int signum) { - void *addresses[NUM_FUNCTIONS]; + void *addresses[MAX_FUNCTIONS]; char **symbols; int n; int i; @@ -70,23 +75,28 @@ handle_signal (int signum) return; } - /* Do not check name for signal trampoline or cancellable syscall - wrappers (__syscall_cancel*). */ - for (; i < n - 1; i++) + /* Skip the signal trampoline and any cancellable syscall wrapper frames + (__syscall_cancel*) and require the read syscall wrapper to be + present. */ + for (i = 1; i < n; i++) if (match (symbols[i], "read")) break; - if (i == n - 1) + if (i == n) { FAIL (); return; } - for (; i < n - 1; i++) - if (!match (symbols[i], "fn")) - { - FAIL (); - return; - } + /* The read wrapper must be followed by the three fn recursion frames. */ + for (int j = 0; j < 3; j++) + { + i++; + if (i == n || !match (symbols[i], "fn")) + { + FAIL (); + return; + } + } /* Symbol names are not available for static functions, so we do not check do_test. */ diff --git a/elf/Makefile b/elf/Makefile index 94c5b7e6ed..8b063e1bba 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -1574,7 +1574,9 @@ $(objpfx)dl-allobjs.os: $(all-rtld-routines:%=$(objpfx)%.os) # when compiled for libc. rtld-stubbed-symbols = \ __libc_assert_fail \ - __syscall_cancel \ + __libc_single_threaded_internal \ + __syscall_cancel_arch \ + __syscall_do_cancel \ calloc \ free \ malloc \ diff --git a/nptl/cancellation.c b/nptl/cancellation.c index 4368cb7231..63f09840ff 100644 --- a/nptl/cancellation.c +++ b/nptl/cancellation.c @@ -19,66 +19,6 @@ #include #include "pthreadP.h" -/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and - returns the syscall value or its negative error code. */ -long int -__internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) -{ - long int result; - struct pthread *pd = THREAD_SELF; - - /* If cancellation is not enabled, call the syscall directly and also - for thread terminatation to avoid call __syscall_do_cancel while - executing cleanup handlers. */ - int ch = atomic_load_relaxed (&pd->cancelhandling); - if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch)) - { - result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6 - __SYSCALL_CANCEL7_ARCH_ARG7); - if (INTERNAL_SYSCALL_ERROR_P (result)) - return -INTERNAL_SYSCALL_ERRNO (result); - return result; - } - - /* Call the arch-specific entry points that contains the globals markers - to be checked by SIGCANCEL handler. */ - result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5, - a6 __SYSCALL_CANCEL7_ARCH_ARG7); - - /* If the cancellable syscall was interrupted by SIGCANCEL and it has no - side-effect, cancel the thread if cancellation is enabled. */ - ch = atomic_load_relaxed (&pd->cancelhandling); - /* The behaviour here assumes that EINTR is returned only if there are no - visible side effects. POSIX Issue 7 has not yet provided any stronger - language for close, and in theory the close syscall could return EINTR - and leave the file descriptor open (conforming and leaks). It expects - that no such kernel is used with glibc. */ - if (result == -EINTR && cancel_enabled_and_canceled (ch)) - __syscall_do_cancel (); - - return result; -} - -/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the - syscall expected success value (usually 0) or, in case of failure, -1 and - sets errno to syscall return value. */ -long int -__syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr) -{ - long int r = __internal_syscall_cancel (a1, a2, a3, a4, a5, a6, - __SYSCALL_CANCEL7_ARG nr); - return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r)) - ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r)) - : r; -} - /* Called by __syscall_cancel_arch or function above start the thread cancellation. */ _Noreturn void diff --git a/nptl/futex-internal.c b/nptl/futex-internal.c index fc6b11c8ad..07f1462abe 100644 --- a/nptl/futex-internal.c +++ b/nptl/futex-internal.c @@ -17,7 +17,7 @@ . */ #include -#include +#include #include #include #include diff --git a/nptl/sem_waitcommon.c b/nptl/sem_waitcommon.c index b0cbe5cebf..82c686f020 100644 --- a/nptl/sem_waitcommon.c +++ b/nptl/sem_waitcommon.c @@ -18,7 +18,7 @@ #include #include -#include +#include #include #include #include diff --git a/sysdeps/unix/sysdep.h b/sysdeps/unix/sysdep.h index a6ce5348ec..f0f271ec02 100644 --- a/sysdeps/unix/sysdep.h +++ b/sysdeps/unix/sysdep.h @@ -154,42 +154,31 @@ # define __SYSCALL_CANCEL7_ARG7 # define __SYSCALL_CANCEL7_ARCH_ARG7 #endif -long int __internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, - __syscall_arg_t a3, __syscall_arg_t a4, - __syscall_arg_t a5, __syscall_arg_t a6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) attribute_hidden; - -long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2, - __syscall_arg_t arg3, __syscall_arg_t arg4, - __syscall_arg_t arg5, __syscall_arg_t arg6, - __SYSCALL_CANCEL7_ARG_DEF - __syscall_arg_t nr) attribute_hidden; #define __SYSCALL_CANCEL0(name) \ - __syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL1(name, a1) \ - __syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL2(name, a1, a2) \ - __syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL3(name, a1, a2, a3) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL4(name, a1, a2, a3, a4) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4), \ - __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC(a4), \ + __SSC (a5), 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ - __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG \ - __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ + __SSC (a5), __SSC (a6), __SYSCALL_CANCEL7_ARG \ + __NR_##name) #define __SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7) \ - __syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ - __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name) + syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), __SSC (a4), \ + __SSC (a5), __SSC (a6), __SSC (a7), __NR_##name) #define __SYSCALL_CANCEL_NARGS_X(a,b,c,d,e,f,g,h,n,...) n #define __SYSCALL_CANCEL_NARGS(...) \ @@ -206,33 +195,33 @@ long int __syscall_cancel (__syscall_arg_t arg1, __syscall_arg_t arg2, __SYSCALL_CANCEL_DISP (__SYSCALL_CANCEL, __VA_ARGS__) #define __INTERNAL_SYSCALL_CANCEL0(name) \ - __internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG \ + internal_syscall_cancel (0, 0, 0, 0, 0, 0, __SYSCALL_CANCEL7_ARG \ __NR_##name) #define __INTERNAL_SYSCALL_CANCEL1(name, a1) \ - __internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), 0, 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL2(name, a1, a2) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), 0, 0, 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL3(name, a1, a2, a3) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, \ - 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), 0, \ + 0, 0, __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL4(name, a1, a2, a3, a4) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), 0, 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), 0, 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL5(name, a1, a2, a3, a4, a5) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC(a4), __SSC (a5), 0, \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC(a4), __SSC (a5), 0, \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL6(name, a1, a2, a3, a4, a5, a6) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC (a4), __SSC (a5), __SSC (a6), \ - __SYSCALL_CANCEL7_ARG __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC (a4), __SSC (a5), __SSC (a6), \ + __SYSCALL_CANCEL7_ARG __NR_##name) #define __INTERNAL_SYSCALL_CANCEL7(name, a1, a2, a3, a4, a5, a6, a7) \ - __internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ - __SSC (a4), __SSC (a5), __SSC (a6), \ - __SSC (a7), __NR_##name) + internal_syscall_cancel (__SSC (a1), __SSC (a2), __SSC (a3), \ + __SSC (a4), __SSC (a5), __SSC (a6), \ + __SSC (a7), __NR_##name) /* Issue a cancellable syscall defined by syscall number NAME plus any other argument required. If an error occurs its value is returned as an negative diff --git a/sysdeps/unix/sysv/linux/epoll_pwait2.c b/sysdeps/unix/sysv/linux/epoll_pwait2.c index 4da03e3e69..76ec1f8a71 100644 --- a/sysdeps/unix/sysv/linux/epoll_pwait2.c +++ b/sysdeps/unix/sysv/linux/epoll_pwait2.c @@ -17,7 +17,7 @@ . */ #include -#include +#include int __epoll_pwait2_time64 (int fd, struct epoll_event *ev, int maxev, diff --git a/sysdeps/unix/sysv/linux/recvmmsg.c b/sysdeps/unix/sysv/linux/recvmmsg.c index 6fbe4b80aa..6a89f914c2 100644 --- a/sysdeps/unix/sysv/linux/recvmmsg.c +++ b/sysdeps/unix/sysv/linux/recvmmsg.c @@ -16,7 +16,7 @@ . */ #include -#include +#include #include static int diff --git a/sysdeps/unix/sysv/linux/sigtimedwait.c b/sysdeps/unix/sysv/linux/sigtimedwait.c index a4fa8e9e8e..c2c5e2c0f2 100644 --- a/sysdeps/unix/sysv/linux/sigtimedwait.c +++ b/sysdeps/unix/sysv/linux/sigtimedwait.c @@ -16,7 +16,7 @@ . */ #include -#include +#include int __sigtimedwait64 (const sigset_t *set, siginfo_t *info, diff --git a/sysdeps/unix/sysv/linux/sysdep-cancel.h b/sysdeps/unix/sysv/linux/sysdep-cancel.h index 7fd8258ba5..4b7278915a 100644 --- a/sysdeps/unix/sysv/linux/sysdep-cancel.h +++ b/sysdeps/unix/sysv/linux/sysdep-cancel.h @@ -21,5 +21,66 @@ #define _SYSDEP_CANCEL_H #include +#include "pthreadP.h" + +/* Called by the INTERNAL_SYSCALL_CANCEL macro, check for cancellation and + returns the syscall value or its negative error code. */ +static __always_inline long int +internal_syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, + __syscall_arg_t a3, __syscall_arg_t a4, + __syscall_arg_t a5, __syscall_arg_t a6, + __SYSCALL_CANCEL7_ARG_DEF + __syscall_arg_t nr) +{ + long int result; + struct pthread *pd = THREAD_SELF; + + /* If cancellation is not enabled, call the syscall directly and also + for thread terminatation to avoid call __syscall_do_cancel while + executing cleanup handlers. */ + int ch = atomic_load_relaxed (&pd->cancelhandling); + if (SINGLE_THREAD_P || !cancel_enabled (ch) || cancel_exiting (ch)) + { + result = INTERNAL_SYSCALL_NCS_CALL (nr, a1, a2, a3, a4, a5, a6 + __SYSCALL_CANCEL7_ARCH_ARG7); + if (INTERNAL_SYSCALL_ERROR_P (result)) + return -INTERNAL_SYSCALL_ERRNO (result); + return result; + } + + /* Call the arch-specific entry points that contains the globals markers + to be checked by SIGCANCEL handler. */ + result = __syscall_cancel_arch (&pd->cancelhandling, nr, a1, a2, a3, a4, a5, + a6 __SYSCALL_CANCEL7_ARCH_ARG7); + + /* If the cancellable syscall was interrupted by SIGCANCEL and it has no + side-effect, cancel the thread if cancellation is enabled. */ + ch = atomic_load_relaxed (&pd->cancelhandling); + /* The behaviour here assumes that EINTR is returned only if there are no + visible side effects. POSIX Issue 7 has not yet provided any stronger + language for close, and in theory the close syscall could return EINTR + and leave the file descriptor open (conforming and leaks). It expects + that no such kernel is used with glibc. */ + if (result == -EINTR && cancel_enabled_and_canceled (ch)) + __syscall_do_cancel (); + + return result; +} + +/* Called by the SYSCALL_CANCEL macro, check for cancellation and return the + syscall expected success value (usually 0) or, in case of failure, -1 and + sets errno to syscall return value. */ +static __always_inline long int +syscall_cancel (__syscall_arg_t a1, __syscall_arg_t a2, + __syscall_arg_t a3, __syscall_arg_t a4, + __syscall_arg_t a5, __syscall_arg_t a6, + __SYSCALL_CANCEL7_ARG_DEF __syscall_arg_t nr) +{ + long int r = internal_syscall_cancel (a1, a2, a3, a4, a5, a6, + __SYSCALL_CANCEL7_ARG nr); + return __glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (r)) + ? SYSCALL_ERROR_LABEL (INTERNAL_SYSCALL_ERRNO (r)) + : r; +} #endif commit 5d1e923ed79185668ac62d19fc37e7e23a3642b6 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:55 2026 -0300 Fix gen-as-const-headers races with the parallel subdir recursion (BZ 34438) The parallel subdirectory recursion (commit 7cac99621e96) only orders csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges the Depend files request. A header generated from gen-as-const-headers is only ordered before the compilations of the subdirectory that adds the .sym (through before-compile), so a header consumed by a different subdirectory may not exist yet when its consumer is compiled. That is the case for : it is generated when building misc, while its only consumer, ____longjmp_chk.S (x86_64 and sh), is built in debug. The serial recursion always ran misc before debug in the sorted order, hiding the missing dependency. Move the generate the header to 'debug' instead. The same class of problem exists on Hurd: jmp_buf-ssp.h that is used by ____longjmp_chk.S in debug, and signal-defines.h that is sued by debug and setjmp. Deterministically reproduced with 'make debug/subdir_lib' from a clean build tree (which orders only csu before debug), and verified with builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu. Reviewed-by: Sam James (cherry picked from commit 60c9ed0e6b9cce07e85ee56fc39b9afe36919e45) diff --git a/Makerules b/Makerules index 6bef57ece9..cef30974f1 100644 --- a/Makerules +++ b/Makerules @@ -259,7 +259,17 @@ endif # gen-py-const-headers ifdef gen-as-const-headers # Generating headers for assembly constants. # We need this defined early to get into before-compile before -# it's used in sysd-rules, below. +# it's used in sysd-rules, below. The gen-as-const-headers is evaluated +# per subdirectory, so the before-compile dependency below only orders +# the generated header before the compiles of the subdirectory whose +# Makefile adds the .sym directive. +# The parallel subdirectory recursion does not order sibling subdirectories, +# so a .sym must be added in the subdirectory that compiles its consumers, +# or in csu (which runs before the parallel) when it has consumers in +# several subdirectories. +# It must not add the same .sym in several subdirectories though: their +# concurrent sub-makes would race generating the header through the fixed +# temporary files below. # Define GEN_AS_CONST_HEADERS to avoid circular dependency [BZ #22792]. # NB: is generated from tcb-offsets.sym to define # offsets and sizes of types in and maybe which diff --git a/NEWS b/NEWS index 28fbd9bcd8..ee292ff6c9 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,8 @@ The following bugs are resolved with this release: [34338] libc: Cancellable syscall wrappers are missing from backtraces because they tail-call __syscall_cancel + [34438] build: non reproducible build failure: sigaltstack-offsets.h: + No such file or directory [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong diff --git a/sysdeps/mach/hurd/x86/Makefile b/sysdeps/mach/hurd/x86/Makefile index 97e3287c87..1d94f3a1c1 100644 --- a/sysdeps/mach/hurd/x86/Makefile +++ b/sysdeps/mach/hurd/x86/Makefile @@ -3,11 +3,7 @@ sysdep_routines += ioperm sysdep_headers += sys/io.h endif -ifeq ($(subdir),debug) -gen-as-const-headers += signal-defines.sym -endif - -ifeq ($(subdir),setjmp) +ifeq ($(subdir),csu) gen-as-const-headers += signal-defines.sym endif diff --git a/sysdeps/unix/sysv/linux/sh/Makefile b/sysdeps/unix/sysv/linux/sh/Makefile index dd3b382ac1..8c4cb73824 100644 --- a/sysdeps/unix/sysv/linux/sh/Makefile +++ b/sysdeps/unix/sysv/linux/sh/Makefile @@ -6,7 +6,9 @@ ifeq ($(subdir),stdlib) gen-as-const-headers += ucontext_i.sym endif -ifeq ($(subdir),misc) +# is only used by ____longjmp_chk.S, which is +# built in the debug subdirectory. +ifeq ($(subdir),debug) gen-as-const-headers += sigaltstack-offsets.sym endif diff --git a/sysdeps/unix/sysv/linux/x86_64/Makefile b/sysdeps/unix/sysv/linux/x86_64/Makefile index 6938382801..528fd951b2 100644 --- a/sysdeps/unix/sysv/linux/x86_64/Makefile +++ b/sysdeps/unix/sysv/linux/x86_64/Makefile @@ -10,7 +10,9 @@ ifeq ($(subdir),csu) gen-as-const-headers += ucontext_i.sym endif -ifeq ($(subdir),misc) +# is only used by ____longjmp_chk.S, which is +# built in the debug subdirectory. +ifeq ($(subdir),debug) gen-as-const-headers += sigaltstack-offsets.sym endif diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 232e388d32..b4434deb0c 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -1,5 +1,12 @@ ifeq ($(subdir),csu) -gen-as-const-headers += cpu-features-offsets.sym features-offsets.sym +# is used by the setjmp/longjmp implementations in the +# setjmp subdirectory and also by ____longjmp_chk.S in the debug +# subdirectory. +gen-as-const-headers += \ + cpu-features-offsets.sym \ + features-offsets.sym \ + jmp_buf-ssp.sym \ + # gen-as-const-headers endif ifeq ($(subdir),elf) @@ -171,7 +178,6 @@ tests += \ endif # $(subdir) == math ifeq ($(subdir),setjmp) -gen-as-const-headers += jmp_buf-ssp.sym sysdep_routines += __longjmp_cancel endif commit 45b8a13c48da92bc5dd6fe102011391dd6847862 Author: Rudi Heitbaum Date: Thu Aug 6 14:07:56 2026 -0300 Makerules: Only install the ABI lib-names header from the top level (BZ 34439) The $(inst_includedir)/%.h install rules exist only where $(headers) is non-empty, so in a subdir without headers (e.g. csu) the prerequisite added on install-others-nosubdir has no rule. It only worked because .NOTPARALLEL made the top level install the header first, which the parallel subdir recursion no longer guarantees. Reviewed-by: Sam James (cherry picked from commit 82c0a96b8e63005a49ba52ddb21993811030613f) diff --git a/Makerules b/Makerules index cef30974f1..dfe66b7fa6 100644 --- a/Makerules +++ b/Makerules @@ -312,7 +312,12 @@ lib-names-h-abi = gnu/lib-names-$(default-abi).h lib-names-stmp-abi = gnu/lib-names-$(default-abi).stmp before-compile += $(common-objpfx)$(lib-names-h-abi) common-generated += gnu/lib-names.h +# The $(inst_includedir)/%.h install rules are defined only where $(headers) +# is non-empty, and with parallel subdir recursion a subdir without headers +# (e.g. csu) may run before the top level has installed the header. +ifndef subdir install-others-nosubdir: $(inst_includedir)/$(lib-names-h-abi) +endif $(common-objpfx)gnu/lib-names.h: $(make-target-directory) { \ diff --git a/NEWS b/NEWS index ee292ff6c9..d0ef2d3e9a 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ The following bugs are resolved with this release: because they tail-call __syscall_cancel [34438] build: non reproducible build failure: sigaltstack-offsets.h: No such file or directory + [34439] build: parallel make install fails on multi-ABI targets: no + rule to make $(inst_includedir)/gnu/lib-names-$(abi).h in csu [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong commit f7beb24f3ad5dbf8e84a5b75d5b2428a262e9ab9 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:57 2026 -0300 Makefile: Only print the test summary in the second pass of 'make check' The build-only first pass of the two-pass 'make check' still runs the static checks (abi, conformtest, installed headers, etc.), and the top-level tests recipe merged and summarized their results. An unexpected FAIL there (e.g. check-abi) aborted 'check' before the second pass ran any built test, and even a clean run printed a misleading partial summary. Pass tests-summary=no in the first pass to skip the merge and summary; the .test-result files persist, so the second pass folds those results into the one complete summary at the end, restoring the single-pass reporting behavior. Reviewed-by: Sam James (cherry picked from commit 96a9a09d7d5527462a823c247569e65feeca8ddb) diff --git a/Makefile b/Makefile index a6aabca691..b9fac6f47c 100644 --- a/Makefile +++ b/Makefile @@ -869,7 +869,11 @@ endif touch $(objpfx)testroot.pristine/install.stamp tests-special-notdir = $(patsubst $(objpfx)%, %, $(tests-special)) +# The build-only first pass of the two-pass 'make check' (see Makerules) +# passes tests-summary=no: the merge and summary are left to the second +# pass, which folds in this pass's $(tests-special) results. tests: $(tests-special) +ifneq ($(tests-summary),no) $(..)scripts/merge-test-results.sh -s $(objpfx) "" \ $(sort $(tests-special-notdir:.out=)) \ > $(objpfx)subdir-tests.sum @@ -877,11 +881,14 @@ tests: $(tests-special) $(sort $(subdirs) .) \ > $(objpfx)tests.sum $(call summarize-tests,tests.sum) +endif xtests: +ifneq ($(tests-summary),no) $(..)scripts/merge-test-results.sh -t $(objpfx) subdir-xtests.sum \ $(sort $(subdirs)) \ > $(objpfx)xtests.sum $(call summarize-tests,xtests.sum, for extra tests) +endif # The realclean target is just like distclean for the parent, but we want # the subdirs to know the difference in case they care. diff --git a/Makerules b/Makerules index dfe66b7fa6..5f65f3ab9e 100644 --- a/Makerules +++ b/Makerules @@ -1211,6 +1211,13 @@ ALL_BUILD_CFLAGS = $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) -D_GNU_SOURCE \ # therefore builds the test programs (run-built-tests=no, recursion fully # parallel) and then runs them (run-built-tests=yes). 'make tests' and a # subdirectory's own 'check' stay single-pass. +# The first pass still runs the static checks ($(tests-special): abi, +# conformtest, installed headers, ...), so tests-summary=no makes it skip +# the results merge and summary: an unexpected FAIL there would otherwise +# abort 'check' before the second pass runs any built test, and even a +# clean run would print a misleading partial summary. The .test-result +# files persist, so the second pass folds those results into the one +# complete summary at the end. check-twopass := ifndef subdir ifeq (yes,$(run-built-tests)) @@ -1219,10 +1226,10 @@ endif endif ifeq (yes,$(check-twopass)) check: - $(MAKE) run-built-tests=no tests + $(MAKE) run-built-tests=no tests-summary=no tests $(MAKE) run-built-tests=yes tests xcheck: - $(MAKE) run-built-tests=no xtests + $(MAKE) run-built-tests=no tests-summary=no xtests $(MAKE) run-built-tests=yes xtests else check: tests commit fc3641194619c7c327ef398c88c07b3069878ed3 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:58 2026 -0300 Makerules: Make the .dt to .d conversion safe against concurrent sub-makes The %.d: %.dt rule seds its input into a fixed temporary name, renames it into place and removes the input. Two makes converting the same file trip over each other: mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory That happens because the elf rtld-Rules recursion runs a sub-make over every $(rtld-subdirs) directory, which converts that directory's .dt files, and the parallel subdirectory recursion (commit 7cac99621e96) runs it concurrently with those subdirectories' own sub-makes. Add the PID of the shell to the temporary name and claim the input with a rename: only the run that wins converts and installs the target. Reviewed-by: Sam James (cherry picked from commit ba8c8801be7674cc12406914184516a811ac22a8) diff --git a/Makerules b/Makerules index 5f65f3ab9e..be51154bae 100644 --- a/Makerules +++ b/Makerules @@ -758,10 +758,20 @@ all-dt-files := $(foreach o,$(object-suffixes-for-libc),$(+depfiles:.d=$o.dt)) $(wildcard $(all-dt-files:.dt=.d)) # This is a funny rule in that it removes its input file. +# +# More than one make can convert the .dt files of a single object +# directory: the elf rtld-Rules recursion runs a sub-make over every +# $(rtld-subdirs) directory, concurrently with that directory's own +# sub-make under the parallel subdir recursion. Add the PID of the +# shell to the temporary name and claim the input with a rename: only +# the run that wins converts and installs the target. %.d: %.dt - @sed $(sed-remove-objpfx) $< > $(@:.d=.T) && \ - mv -f $(@:.d=.T) $@ && \ - rm -f $< + @dt=$(@:.d=.T)$$$$; \ + if mv -f $< $$dt 2>/dev/null; then \ + sed $(sed-remove-objpfx) $$dt > $$dt.new && \ + mv -f $$dt.new $@ && \ + rm -f $$dt; \ + fi # Avoid the .h.d files for any .sym files whose .h files don't exist yet. # They will be generated when they're needed, and trying too early won't work. @@ -1433,7 +1443,7 @@ endef # Also remove the dependencies and generated source files. common-clean: common-mostlyclean -rm -f $(addprefix $(objpfx),$(generated)) - -rm -f $(objpfx)*.d $(objpfx)*.dt + -rm -f $(objpfx)*.d $(objpfx)*.dt $(objpfx)*.T[0-9]* -rm -fr $(addprefix $(objpfx),$(generated-dirs)) -rm -f $(addprefix $(common-objpfx),$(common-generated)) -rm -f $(gen-as-const-headers:%.sym=$(common-objpfx)%.h) commit f34027b27fefbc94aab04bff613ba5c24fb909b1 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:59 2026 -0300 Makefile: Order the top-level stamp files before the subdirectory fan-out The archive rules in Makerules list every stamp file as a prerequisite, including the top level's own, and the elf sub-make evaluates them to build libc_pic.a for the librtld.map link. A sub-make can only create the stamp files of its own directory, so when the top-level ones do not exist yet it fails with: make[2]: *** No rule to make target '.../stamp.os', needed by '.../libc_pic.a'. Stop. The serial recursion created them before the subdirectories through the prerequisite order of subdir_lib; the parallel recursion (commit 7cac99621e96) does not. Add them as prerequisites of the object-building per-subdirectory targets. Reviewed-by: Sam James (cherry picked from commit 25c42d04c45fc5fdb1481a7f968782791b21fd3e) diff --git a/Makefile b/Makefile index b9fac6f47c..d559c42873 100644 --- a/Makefile +++ b/Makefile @@ -575,6 +575,14 @@ $(foreach t,$(+elf_last_subdir_targets),$(eval \ elf/$(t): $(addsuffix /$(t),$(filter-out elf,$(subdirs))))) endif +# The archive rules in Makerules list every stamp file as a +# prerequisite of libc_pic.a, which the elf sub-make evaluates for the +# librtld.map link, but a sub-make can only create its own directory's +# stamps. Create the top-level ones before the fan-out. +$(foreach t,$(+elf_last_subdir_targets),$(eval \ + $(addsuffix /$(t),$(subdirs)): \ + $(foreach o,$(object-suffixes-for-libc),$(common-objpfx)stamp$(o)))) + # Pass barriers: a subdirectory 'others' build links programs against # the libraries, so the 'lib' pass (including the top-level libc.so # link) must have completed. commit 10e3ce8a57e134c13dd28772de68542b0e3d4e86 Author: Adhemerval Zanella Date: Thu Aug 6 14:08:00 2026 -0300 arm: Order the rtld link after libgcc-stubs.a The librtld.map and librtld.os link recipes use $(gnulib), which on arm contains libgcc-stubs.a through gnulib-arch. But the archive is only a prerequisite of lib-noranlib so the rtld link can run before the archive exists: ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory The race seems to predates the parallel subdirectory recursion, which only made it observable. Add the order-only dependency in sysdeps/arm/Makefile rather than in elf/Makefile. Theprerequisite lists expand when the rule is parsed, and gnulib-arch is only defined once Makerules includes the sysdeps makefiles. Verified with a build for arm-linux-gnueabihf. Reviewed-by: Sam James (cherry picked from commit a33ceb6e96dc8de8d36de1b1f3ec06ceb524d012) diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile index 0bb1b6e05b..9042315492 100644 --- a/sysdeps/arm/Makefile +++ b/sysdeps/arm/Makefile @@ -10,6 +10,11 @@ shared-only-routines += aeabi_unwind_cpp_pr1 $(objpfx)libgcc-stubs.a: $(objpfx)aeabi_unwind_cpp_pr1.os $(build-extra-lib) +# The rtld link recipes in elf/Makefile use $(gnulib), which here +# includes libgcc-stubs.a, but they cannot name it as a prerequisite: +# gnulib-arch is only defined once this file is included from Makerules. +$(objpfx)librtld.map $(objpfx)librtld.os: | $(objpfx)libgcc-stubs.a + lib-noranlib: $(objpfx)libgcc-stubs.a ifeq ($(build-shared),yes) commit 26b9cc42a051f78233fcecd2a3b83f98ec9862b9 Author: Adhemerval Zanella Date: Tue Jul 28 11:27:33 2026 -0300 benchtests: Create objdir in the bench-%.c generation rule The $(objpfx)bench-%.c rule writes its output into $(objpfx) without ensuring that directory exists. Serial builds happened to satisfy that ordering, with parallel builds the generation recipe can run before the directory is created, failing with: cannot create .../benchtests/bench-xxx.c-tmp: Directory nonexistent Add the standard $(make-target-directory). Reviewed-by: Florian Weimer (cherry picked from commit 26f0f2aa7d6ea63f85b5186349c41de2c91b4dd7) diff --git a/benchtests/Makefile b/benchtests/Makefile index f407e492cb..16cc951d19 100644 --- a/benchtests/Makefile +++ b/benchtests/Makefile @@ -622,6 +622,7 @@ $(bench-link-targets): %: %.o $(objpfx)json-lib.o \ $(bench-link-targets): LDFLAGS += $(link-bench-bind-now) $(objpfx)bench-%.c: %-inputs $(bench-deps) + $(make-target-directory) { if [ -n "$($*-INCLUDE)" ]; then \ cat $($*-INCLUDE); \ fi; \ commit 4662c4675d7f3ba87637c61730f06071f305c5cb Author: Xi Ruoyao Date: Sun Jul 26 00:11:44 2026 +0800 elf: test: handle different rootsbindir in tst-ldconfig-cache When compiling a glibc for a merged-/usr distro people may set rootsbindir=/usr/sbin. But tst-ldconfig-cache has hard-coded /sbin/ldconfig path and so it fails with a different rootsbindir. Fix it by using support_install_rootsbindir like run_ldconfig in test-container.c. Signed-off-by: Xi Ruoyao Reviewed-by: Florian Weimer (cherry picked from commit 02ea17b5add83a205d8b204dce28f38fe0498ea3) diff --git a/elf/tst-ldconfig-cache.c b/elf/tst-ldconfig-cache.c index 9f71418b3a..f4820a1822 100644 --- a/elf/tst-ldconfig-cache.c +++ b/elf/tst-ldconfig-cache.c @@ -85,7 +85,10 @@ corrupt (void) static void ldconfig (void) { - xsystem ("/sbin/ldconfig -X"); + char *cmd = xasprintf("%s/ldconfig -X", support_install_rootsbindir); + xsystem (cmd); + + free(cmd); } /* Change ld.so.conf to refer to the new directory, and generate a new commit 9e1b1ef77c7b1cc58f625500e9ea74fb3cafdf12 Author: Matt Turner Date: Sun Jul 26 00:27:37 2026 -0400 ldbl-opt: Fix -mlong-double-128 configure test for Clang The check for -mlong-double-128 support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail (and thus the whole build error out) with Clang even though it supports -mlong-double-128. Use AC_LANG_SOURCE so the function is defined at file scope, matching the pattern already used by the powerpc64le compiler checks, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit e7a14f03b8d5e34e8ac46db6c377da5c66a3ec2a) diff --git a/sysdeps/ieee754/ldbl-opt/configure b/sysdeps/ieee754/ldbl-opt/configure old mode 100644 new mode 100755 index bc6552da0b..7769cc9781 --- a/sysdeps/ieee754/ldbl-opt/configure +++ b/sysdeps/ieee754/ldbl-opt/configure @@ -13,17 +13,10 @@ CFLAGS="$CFLAGS -mlong-double-128" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -int -main (void) -{ - #ifndef __LONG_DOUBLE_128__ # error "compiler did not predefine __LONG_DOUBLE_128__ as expected" #endif long double foobar (long double x) { return x; } - ; - return 0; -} _ACEOF if ac_fn_c_try_compile "$LINENO" then : diff --git a/sysdeps/ieee754/ldbl-opt/configure.ac b/sysdeps/ieee754/ldbl-opt/configure.ac index 70e3b32dc6..1c500ad581 100644 --- a/sysdeps/ieee754/ldbl-opt/configure.ac +++ b/sysdeps/ieee754/ldbl-opt/configure.ac @@ -6,7 +6,7 @@ AC_CACHE_CHECK(whether $CC $CFLAGS supports -mlong-double-128, libc_cv_mlong_double_128, [dnl save_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -mlong-double-128" -AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[ +AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ #ifndef __LONG_DOUBLE_128__ # error "compiler did not predefine __LONG_DOUBLE_128__ as expected" #endif commit eacd9cced93498e671c7e7f758aaf52593847e01 Author: Matt Turner Date: Sun Jul 26 14:43:11 2026 -0400 powerpc: Fix -mlong-double-128 IBM format configure test for Clang The check for -mlong-double-128 IBM extended format support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail with Clang. Use AC_LANG_SOURCE so the function is defined at file scope, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit 559d0f77f3ee1000cf8a2d0baba7a59a1ec45f50) diff --git a/sysdeps/unix/sysv/linux/powerpc/configure b/sysdeps/unix/sysv/linux/powerpc/configure index ef2055db92..eb8578404f 100644 --- a/sysdeps/unix/sysv/linux/powerpc/configure +++ b/sysdeps/unix/sysv/linux/powerpc/configure @@ -12,18 +12,12 @@ else case e in #( CFLAGS="$CFLAGS -mlong-double-128" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -#include -int -main (void) -{ +#include #if LDBL_MANT_DIG != 106 # error "compiler doesn't implement IBM extended format of long double" #endif long double foobar (long double x) { return x; } - ; - return 0; -} _ACEOF if ac_fn_c_try_compile "$LINENO" then : diff --git a/sysdeps/unix/sysv/linux/powerpc/configure.ac b/sysdeps/unix/sysv/linux/powerpc/configure.ac index 42347a66fc..ca0f82da08 100644 --- a/sysdeps/unix/sysv/linux/powerpc/configure.ac +++ b/sysdeps/unix/sysv/linux/powerpc/configure.ac @@ -6,7 +6,8 @@ AC_CACHE_CHECK(whether $CC $CFLAGS -mlong-double-128 uses IBM extended format, libc_cv_mlong_double_128ibm, [dnl save_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -mlong-double-128" -AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ +AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ +#include #if LDBL_MANT_DIG != 106 # error "compiler doesn't implement IBM extended format of long double" #endif commit 89da37bb6e4a631f375b5fe48783e5c023441b0c Author: Matt Turner Date: Tue Aug 4 10:17:20 2026 -0400 stdio-common: run AWK in the C locale in the printf format tests The program under test runs in the C locale, through the test program prefix, but AWK inherits whatever locale the build was started in. They agree today only because the locale in use shares its decimal point with the C locale. It is also faster. gawk takes a single byte path in its regular expression engine when MB_CUR_MAX is 1, and the script matches several expressions against every line. For the %f conversion for double, the largest of these tests, as the median of five runs: x86_64, gawk 5.4.1 1.482s -> 1.248s x86_64, gawk 5.3.2 0.911s -> 0.703s alpha, gawk 5.4.60 30.9s -> 26.6s Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at 1.248s against 0.703s for the same input in the C locale, so these tests have become more expensive than they used to be. Reviewed-by: Adhemerval Zanella (cherry picked from commit 866a70167b85903a02d4ccacb91afb8922702c14) diff --git a/stdio-common/tst-printf-format-c.sh b/stdio-common/tst-printf-format-c.sh index 825c50ec42..73d28c5607 100644 --- a/stdio-common/tst-printf-format-c.sh +++ b/stdio-common/tst-printf-format-c.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" echo Verifying c (set -o pipefail diff --git a/stdio-common/tst-printf-format-char.sh b/stdio-common/tst-printf-format-char.sh index 7867bdd62f..aa4d211126 100644 --- a/stdio-common/tst-printf-format-char.sh +++ b/stdio-common/tst-printf-format-char.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-double.sh b/stdio-common/tst-printf-format-double.sh index 8157092dc4..051e4716c5 100644 --- a/stdio-common/tst-printf-format-double.sh +++ b/stdio-common/tst-printf-format-double.sh @@ -29,7 +29,7 @@ test_program_prefix=$1; shift # internally to process the conversion requested, so any bug in our code # would then be verified against itself, defeating the objective of doing # the verification against an independent implementation. -AWK="${AWK:-awk} -M" +AWK="env LC_ALL=C ${AWK:-awk} -M" status=77 diff --git a/stdio-common/tst-printf-format-int.sh b/stdio-common/tst-printf-format-int.sh index 8542ff4150..e9dcbedc04 100644 --- a/stdio-common/tst-printf-format-int.sh +++ b/stdio-common/tst-printf-format-int.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ldouble.sh b/stdio-common/tst-printf-format-ldouble.sh index dbf78a98c6..7ee097ac0a 100644 --- a/stdio-common/tst-printf-format-ldouble.sh +++ b/stdio-common/tst-printf-format-ldouble.sh @@ -29,7 +29,7 @@ test_program_prefix=$1; shift # internally to process the conversion requested, so any bug in our code # would then be verified against itself, defeating the objective of doing # the verification against an independent implementation. -AWK="${AWK:-awk} -M" +AWK="env LC_ALL=C ${AWK:-awk} -M" status=77 diff --git a/stdio-common/tst-printf-format-llong.sh b/stdio-common/tst-printf-format-llong.sh index e1f5252c9a..98a79660cc 100644 --- a/stdio-common/tst-printf-format-llong.sh +++ b/stdio-common/tst-printf-format-llong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-long.sh b/stdio-common/tst-printf-format-long.sh index 4b68ab1e04..89ac3302b8 100644 --- a/stdio-common/tst-printf-format-long.sh +++ b/stdio-common/tst-printf-format-long.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-s.sh b/stdio-common/tst-printf-format-s.sh index 65aa0cb675..015c730609 100644 --- a/stdio-common/tst-printf-format-s.sh +++ b/stdio-common/tst-printf-format-s.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" echo Verifying s (set -o pipefail diff --git a/stdio-common/tst-printf-format-short.sh b/stdio-common/tst-printf-format-short.sh index 30357baa02..a7df8b8e6d 100644 --- a/stdio-common/tst-printf-format-short.sh +++ b/stdio-common/tst-printf-format-short.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-uchar.sh b/stdio-common/tst-printf-format-uchar.sh index 08a6914b88..356de4217d 100644 --- a/stdio-common/tst-printf-format-uchar.sh +++ b/stdio-common/tst-printf-format-uchar.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 diff --git a/stdio-common/tst-printf-format-uint.sh b/stdio-common/tst-printf-format-uint.sh index 0ba203ccda..b496047a49 100644 --- a/stdio-common/tst-printf-format-uint.sh +++ b/stdio-common/tst-printf-format-uint.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ullong.sh b/stdio-common/tst-printf-format-ullong.sh index 5b881ab924..f030f66a24 100644 --- a/stdio-common/tst-printf-format-ullong.sh +++ b/stdio-common/tst-printf-format-ullong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ulong.sh b/stdio-common/tst-printf-format-ulong.sh index f6aeb8e3c0..7102575ed2 100644 --- a/stdio-common/tst-printf-format-ulong.sh +++ b/stdio-common/tst-printf-format-ulong.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=77 diff --git a/stdio-common/tst-printf-format-ushort.sh b/stdio-common/tst-printf-format-ushort.sh index 07609128ab..5f612b5398 100644 --- a/stdio-common/tst-printf-format-ushort.sh +++ b/stdio-common/tst-printf-format-ushort.sh @@ -23,7 +23,7 @@ xprintf=$1; shift common_objpfx=$1; shift test_program_prefix=$1; shift -AWK=${AWK:-awk} +AWK="env LC_ALL=C ${AWK:-awk}" status=0 commit 7cc7a3a4fbf15c8a7d61a69452f754f9c352cd62 Author: Matt Turner Date: Mon Aug 3 21:59:44 2026 -0400 stdio-common: avoid repeated regexp matches in tst-printf-format.awk Whether the value is an infinity, a NaN or zero does not change between the conversions applied to it, but was determined again for each one. Determine it where the value is read. Also look for the '#' flag with index() before matching the expressions that need it, and test the value first where both have to hold. For the %f conversion for double, in the C locale, as the median of five runs: x86_64, gawk 5.4.1 1.248s -> 1.184s x86_64, gawk 5.3.2 0.703s -> 0.708s alpha, gawk 5.4.60 26.6s -> 25.8s So this only helps with the regular expression engine that gawk 5.4 brought in; under 5.3.2 it is lost in the noise. Output and exit status are unchanged for the e, f and g conversions for double under both gawk versions and both locales. Reviewed-by: Adhemerval Zanella (cherry picked from commit 0cc3f9b3f3f2950844bd41cc8923215cd5d97269) diff --git a/stdio-common/tst-printf-format.awk b/stdio-common/tst-printf-format.awk index 5d0324c551..57bea12621 100644 --- a/stdio-common/tst-printf-format.awk +++ b/stdio-common/tst-printf-format.awk @@ -32,6 +32,9 @@ BEGIN { # non-bignum mode unless a sign has been explicitly given. Keep # original 'val' for reporting. value = gensub(/^(INF|NAN|inf|nan)/, "+\\1", 1, val) + # Neither changes between the conversions applied to this value. + value_infnan = value ~ /(INF|NAN|inf|nan)/ + value_zero = value == 0 next } @@ -52,7 +55,7 @@ BEGIN { # Discard the '#' flag with the octal conversion if output starts with # 0 in the absence of this flag. In that case no extra 0 is supposed # to be produced, but gawk prepends it anyway. - if (format ~ /#.*o/) + if (index(format, "#") && format ~ /#.*o/) { tmpfmt = gensub(/#/, "", "g", format) tmpout = sprintf(tmpfmt, value) @@ -62,7 +65,7 @@ BEGIN { # Likewise with the hexadecimal conversion where zero value with the # precision of zero is supposed to produce no characters, but gawk # outputs 0 instead. - else if (format ~ /#.*[Xx]/) + else if (index(format, "#") && format ~ /#.*[Xx]/) { tmpfmt = gensub(/#/, "", "g", format) tmpout = sprintf(tmpfmt, value) @@ -78,7 +81,7 @@ BEGIN { # values and reprint the output produced using the string conversion, # with the field width carried over and the relevant flags handled by # hand. - if (format ~ /[EFGefg]/ && value ~ /(INF|NAN|inf|nan)/) + if (value_infnan && format ~ /[EFGefg]/) { minus = format ~ /-/ ? "-" : "" sign = value ~ /-/ ? "-" : format ~ /\+/ ? "+" : format ~ / / ? " " : "" @@ -94,7 +97,7 @@ BEGIN { # In that case "+" is always supposed to be produced, but with the # precision of zero gawk in the non-bignum mode produces any padding # requested only. - else if (format ~ /\+.*[di]/ && value == 0) + else if (value_zero && format ~ /\+.*[di]/) { output = gensub(/^( *) $/, format ~ /-/ ? "+\\1" : "\\1+", 1, output) output = gensub(/^$/, "+", 1, output) @@ -103,7 +106,7 @@ BEGIN { # conversion for zero value. In that case at least one " " is # supposed to be produced, but with the precision of zero gawk in the # non-bignum mode produces nothing. - else if (format ~ / .*[di]/ && value == 0) + else if (value_zero && format ~ / .*[di]/) { output = gensub(/^$/, " ", 1, output) } commit 65d35639a9d055e423345c8748908c8aa48b19b9 Author: Magnus Lindholm Date: Wed Aug 5 23:14:58 2026 +0200 string: Speed up strcmp test data initialization The strcmp and strncmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and two individual stores for every element. Generate at most max_char elements using an additive recurrence. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand this initial pattern using bulk copies, and then copy the completed first buffer to the second buffer. This preserves the generated test data while substantially reducing the initialization cost on slower systems. The change also applies to the wcscmp and wcsncmp tests, which include the same test sources. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit 9b323b95567dff46b34157ac4455734633921abb) diff --git a/string/test-strcmp.c b/string/test-strcmp.c index 76ccff46e2..ca52827b11 100644 --- a/string/test-strcmp.c +++ b/string/test-strcmp.c @@ -156,6 +156,10 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t pattern_len; + size_t step + = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char; CHAR *s1, *s2; @@ -179,8 +183,28 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, i = align2 + CHARBYTES * (len + 2); s2 = (CHAR *)(buf2 + ((page_size - i) / 16 * 16) + align2); - for (i = 0; i < len; i++) - s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char; + /* The generated sequence repeats after at most max_char elements. */ + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) + { + s1[i] = 1 + value; + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + MEMCPY (s1 + i, s1, copy); + i += copy; + } + + MEMCPY (s2, s1, len); s1[len] = s2[len] = 0; s1[len + 1] = 23; diff --git a/string/test-strncmp.c b/string/test-strncmp.c index 54ada39eb2..9da0f21f60 100644 --- a/string/test-strncmp.c +++ b/string/test-strncmp.c @@ -190,6 +190,9 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds, { size_t i, buf_bound; CHAR *s1, *s2, *s1_end, *s2_end; + size_t value = 0; + size_t pattern_len; + size_t step = (23U << ((CHARBYTES - 1) * 8)) % (size_t) max_char; align1 &= ~(CHARBYTES - 1); align2 &= ~(CHARBYTES - 1); @@ -216,8 +219,29 @@ do_test_n (size_t align1, size_t align2, size_t len, size_t n, int n_in_bounds, s2[n] = 23; } - for (i = 0; i < buf_bound; i++) - s1[i] = s2[i] = 1 + (23 << ((CHARBYTES - 1) * 8)) * i % max_char; + /* The generated sequence repeats after at most max_char elements. */ + pattern_len + = buf_bound < (size_t) max_char + ? buf_bound : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) + { + s1[i] = 1 + value; + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < buf_bound) + { + size_t copy = i < buf_bound - i ? i : buf_bound - i; + + MEMCPY (s1 + i, s1, copy); + i += copy; + } + + MEMCPY (s2, s1, buf_bound); s1[len] = 0; s2[len] = 0; commit 11ac3d78fc5e4f7f2846002e099f773ad8ff82fc Author: Magnus Lindholm Date: Wed Aug 5 23:14:59 2026 +0200 string: Speed up strcasecmp test data initialization The strcasecmp and strncasecmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and call toupper and tolower for every element. Generate at most max_char elements using an additive recurrence and apply the case conversions while creating this initial pattern. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand the completed pattern using bulk copies. This preserves the generated test data and locale-dependent case conversion while substantially reducing the initialization cost on slower systems. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit c1fb5d0e6b8d292ac526974d05c5adb4c3827fb0) diff --git a/string/test-strcasecmp.c b/string/test-strcasecmp.c index a5235fa1bb..d090dcbf36 100644 --- a/string/test-strcasecmp.c +++ b/string/test-strcasecmp.c @@ -63,6 +63,9 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t step = 23U % (size_t) max_char; + size_t pattern_len; char *s1, *s2; if (len == 0) @@ -80,10 +83,25 @@ do_test (size_t align1, size_t align2, size_t len, int max_char, s1 = (char *) (buf1 + align1); s2 = (char *) (buf2 + align2); - for (i = 0; i < len; i++) + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) { - s1[i] = toupper (1 + 23 * i % max_char); + s1[i] = toupper (1 + value); s2[i] = tolower (s1[i]); + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + memcpy (s1 + i, s1, copy); + memcpy (s2 + i, s2, copy); + i += copy; } s1[len] = s2[len] = 0; diff --git a/string/test-strncasecmp.c b/string/test-strncasecmp.c index 035c680532..6b00113e66 100644 --- a/string/test-strncasecmp.c +++ b/string/test-strncasecmp.c @@ -83,6 +83,9 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char, int exp_result) { size_t i; + size_t value = 0; + size_t step = 23U % (size_t) max_char; + size_t pattern_len; char *s1, *s2; if (len == 0) @@ -100,10 +103,26 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char, s1 = (char *) (buf1 + align1); s2 = (char *) (buf2 + align2); - for (i = 0; i < len; i++) + pattern_len + = len < (size_t) max_char ? len : (size_t) max_char; + + for (i = 0; i < pattern_len; i++) { - s1[i] = toupper (1 + 23 * i % max_char); + s1[i] = toupper (1 + value); s2[i] = tolower (s1[i]); + + value += step; + if (value >= (size_t) max_char) + value -= max_char; + } + + while (i < len) + { + size_t copy = i < len - i ? i : len - i; + + memcpy (s1 + i, s1, copy); + memcpy (s2 + i, s2, copy); + i += copy; } s1[len] = s2[len] = 0; commit 16be1518495f1fa05481b0182c4e4c24927c62df Author: Adhemerval Zanella Date: Mon Aug 3 11:02:53 2026 -0300 elf: Honour skip_ifunc for cross-object IFUNC relocations [BZ #34428] Commit 63b31c05a8a ("elf: Defer all IRELATIVE relocations until after PLT setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation that may run an IFUNC resolver. That only holds for IFUNC symbols defined in the object being relocated: a reference to an IFUNC in another object is an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC nature is only known after symbol resolution inside elf_machine_rel. Those relocations stay in the regular pass, which no longer propagated skip_ifunc, so __RTLD_NOIFUNC was ignored for them. ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so the resolver was called and the diagnostic emitted: $ ldd -u /bin/ls /bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk' ldd -r with LD_BIND_NOW is affected in the same way. Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC. This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading (it reads as "do not process IFUNC", yet it takes a skip_ifunc argument). Replace it to: DL_RELOC_BOTH -> DL_RELOC_ALL DL_RELOC_NOIFUNC -> DL_RELOC_NORMAL DL_RELOC_IFUNC -> DL_RELOC_IRELATIVE ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three near-identical variants each. Checked on x86_64-linux-gnu, and built for all supported architectures. Reviewed-by: Sam James (cherry picked from commit 2f2e9bae4093e1c3ba61250e340d3c3b99788f68) diff --git a/elf/Makefile b/elf/Makefile index 8b063e1bba..d279a5135c 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -1396,6 +1396,13 @@ modules-names += \ tst-ifunc-tls-write-lib \ tst-tls-tdata-reloc-lib \ # modules-names +ifeq (yes,$(have-gcc-ifunc)) +tests += \ + tst-ifunc-fault-dep-bindnow \ + tst-ifunc-fault-dep-lazy \ + # tests +modules-names += tst-ifunc-fault-mod +endif ifneq (no,$(have-test-mtls-descriptor)) tests += tst-ifunc-tls-init-tlsdesc modules-names += tst-ifunc-tls-init-tlsdesc-lib @@ -2547,6 +2554,27 @@ $(objpfx)tst-ifunc-fault-bindnow.out: $(objpfx)tst-ifunc-fault-bindnow \ $(objpfx)ld.so $(tst-ifunc-fault-script) +LDFLAGS-tst-ifunc-fault-dep-lazy = -Wl,-z,lazy +LDFLAGS-tst-ifunc-fault-dep-bindnow = -Wl,-z,now +define tst-ifunc-fault-dep-script +( $(test-wrapper) $(rtld-prefix) --verify $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 $(rtld-prefix) $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_DEBUG=unused \ + $(rtld-prefix) $< \ + && $(test-wrapper-env) LD_TRACE_LOADED_OBJECTS=1 LD_WARN=yes LD_BIND_NOW=1 \ + $(rtld-prefix) $< \ +) > $@; $(evaluate-test) +endef +$(objpfx)tst-ifunc-fault-dep-lazy: $(objpfx)tst-ifunc-fault-mod.so +$(objpfx)tst-ifunc-fault-dep-bindnow: $(objpfx)tst-ifunc-fault-mod.so +$(objpfx)tst-ifunc-fault-dep-lazy.out: $(objpfx)tst-ifunc-fault-dep-lazy \ + $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so + $(tst-ifunc-fault-dep-script) +$(objpfx)tst-ifunc-fault-dep-bindnow.out: \ + $(objpfx)tst-ifunc-fault-dep-bindnow \ + $(objpfx)tst-ifunc-fault-mod.so $(objpfx)ld.so + $(tst-ifunc-fault-dep-script) + LDFLAGS-tst-ifunc-plt-lib.so = -Wl,-z,lazy tst-ifunc-plt-bindnow-ENV = LD_BIND_NOW=1 diff --git a/elf/dl-reloc-static-pie.c b/elf/dl-reloc-static-pie.c index 8463e46147..5dc5a545a8 100644 --- a/elf/dl-reloc-static-pie.c +++ b/elf/dl-reloc-static-pie.c @@ -80,7 +80,7 @@ _dl_relocate_static_pie (void) /* Relocate ourselves so we can do normal function calls and data access using the global offset table. IRELATIVE entries are deferred. */ - ELF_DYNAMIC_RELOCATE_NOIFUNC (main_map, NULL, 0, 0); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, main_map, NULL, 0, 0, 0); /* Initialize _r_debug_extended. */ struct r_debug *r = _dl_debug_initialize (0, LM_ID_BASE); @@ -98,7 +98,7 @@ void _dl_relocate_static_pie_ifunc (void) { struct link_map *main_map = _dl_get_dl_main_map (); - ELF_DYNAMIC_RELOCATE_IFUNC (main_map, NULL, 0, 0); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, main_map, NULL, 0, 0, 0); main_map->l_relocated = 1; } #endif diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c index 15a6a4cffe..fa2f41ac44 100644 --- a/elf/dl-reloc.c +++ b/elf/dl-reloc.c @@ -278,7 +278,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[], IFUNC resolvers. Without this, a resolver would see the unrelocated initialiser bytes that were placed into the slot by the early _dl_allocate_tls_init. */ - ELF_DYNAMIC_RELOCATE_NOIFUNC (l, scope, lazy, consider_profiling); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_NORMAL, l, scope, lazy, + consider_profiling, skip_ifunc); #ifdef SHARED /* Re-initialise the static TLS slot with the .tdata so the IRELATIVE @@ -291,7 +292,8 @@ _dl_relocate_object_no_relro (struct link_map *l, struct r_scope_elem *scope[], _dl_init_static_tls (l); #endif - ELF_DYNAMIC_RELOCATE_IFUNC (l, scope, lazy, skip_ifunc); + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_IRELATIVE, l, scope, lazy, + 0, skip_ifunc); if ((consider_profiling || consider_symbind) && l->l_info[DT_PLTRELSZ] != NULL) diff --git a/elf/do-rel.h b/elf/do-rel.h index 7702244734..c610d12dbe 100644 --- a/elf/do-rel.h +++ b/elf/do-rel.h @@ -79,17 +79,23 @@ elf_dynamic_Rel_audit_symbind (struct link_map *map, /* Perform the relocations in MAP on the running program image as specified by RELTAG, SZTAG. If LAZY is nonzero, this is the first pass on PLT relocations; they should be set up to call _dl_runtime_resolve, rather - than fully resolved now. + than fully resolved now. If SKIP_IFUNC is nonzero no IFUNC resolver is + called; this is required for the trace modes (ldd -u / ldd -r), which + relocate objects. - IRELATIVE entries are always skipped (non-bootstrap); they are handled + IRELATIVE entries and relocations against an STT_GNU_IFUNC symbol defined + in MAP itself are always skipped (non-bootstrap); they are handled separately by elf_dynamic_do_Rel_irelative after all other relocations - for both .rel.dyn and .rel.plt have been processed. */ + for both .rel.dyn and .rel.plt have been processed. Relocations against + an IFUNC symbol defined in *another* object are not deferred, since the + IFUNC symbol is only known after symbol resolution, and the defining object + has already been relocated at this point. */ static inline void __attribute__ ((always_inline)) elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], ElfW(Addr) reladdr, ElfW(Addr) relsize, __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative, - int lazy) + int lazy, int skip_ifunc) { const ElfW(Rel) *relative = (const void *) reladdr; const ElfW(Rel) *r = relative + nrelative; @@ -111,7 +117,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], void *const r_addr_arg = (void *) (l_addr + r->r_offset); const struct r_found_version *rversion = &map->l_versions[ndx]; - elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, skip_ifunc); } #else /* !RTLD_BOOTSTRAP */ #if !defined DO_RELA || !defined ELF_MACHINE_PLT_REL @@ -126,7 +132,7 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], const ElfW (Sym) *sym = &symtab[ELFW (R_SYM) (r->r_info)]; if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_lazy_rel (map, scope, l_addr, r, 0); + elf_machine_lazy_rel (map, scope, l_addr, r, skip_ifunc); } } else @@ -158,7 +164,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, rversion, r_addr_arg, + skip_ifunc); elf_dynamic_Rel_audit_symbind (map, scope, r, sym, rversion, r_addr_arg); } @@ -172,7 +179,8 @@ elf_dynamic_do_Rel (struct link_map *map, struct r_scope_elem *scope[], if (elf_dynamic_is_Rel_irelative (r, sym)) continue; - elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg, 0); + elf_machine_rel (map, scope, r, sym, NULL, r_addr_arg, + skip_ifunc); elf_dynamic_Rel_audit_symbind (map, scope, r, sym, NULL, r_addr_arg); } diff --git a/elf/dynamic-link.h b/elf/dynamic-link.h index 35141acec4..0130c63feb 100644 --- a/elf/dynamic-link.h +++ b/elf/dynamic-link.h @@ -78,18 +78,23 @@ elf_machine_lazy_rel (struct link_map *map, struct r_scope_elem *scope[], consumes precisely the very end of the DT_REL*, or DT_JMPREL and DT_REL* are completely separate and there is a gap between them. */ -/* This controls which sub-passes _ELF_DYNAMIC_DO_RELOC runs. Used to - interleave TLS / stack-protector setup between the two passes so IFUNC - resolvers see a fully-initialised TCB. */ -enum elf_dynamic_reloc_phase +/* Selects which relocations a pass processes. Splitting them allows the + caller to interleave TLS / stack-protector setup between the two passes, + so IFUNC resolvers see a fully-initialised TCB. + + This is orthogonal to the skip_ifunc argument, which says whether an IFUNC + resolver may be run at all and is honoured by every pass. In particular + DL_RELOC_NORMAL also runs IFUNC resolvers, for relocations against an + IFUNC symbol defined in another object. */ +enum elf_dynamic_reloc_pass { - DL_RELOC_BOTH = 0, /* Non-IRELATIVE pass then IRELATIVE pass. */ - DL_RELOC_NOIFUNC = 1, /* Non-IRELATIVE pass only. */ - DL_RELOC_IFUNC = 2, /* IRELATIVE pass only. */ + DL_RELOC_ALL = 0, /* Non-IRELATIVE relocations, then IRELATIVE. */ + DL_RELOC_NORMAL = 1, /* Non-IRELATIVE relocations only. */ + DL_RELOC_IRELATIVE = 2, /* IRELATIVE relocations only. */ }; # define _ELF_DYNAMIC_DO_RELOC(RELOC, reloc, map, scope, do_lazy, skip_ifunc, \ - test_rel, phase) \ + test_rel, pass) \ do { \ struct { ElfW(Addr) start, size; \ __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative; int lazy; } \ @@ -136,14 +141,15 @@ enum elf_dynamic_reloc_phase by the linker. */ \ if (!DO_RTLD_BOOTSTRAP) \ { \ - if ((phase) != DL_RELOC_IFUNC) \ + if ((pass) != DL_RELOC_IRELATIVE) \ for (int ranges_index = 0; ranges_index < 2; ++ranges_index) \ elf_dynamic_do_##reloc ((map), scope, \ ranges[ranges_index].start, \ ranges[ranges_index].size, \ ranges[ranges_index].nrelative, \ - ranges[ranges_index].lazy); \ - if ((phase) != DL_RELOC_NOIFUNC) \ + ranges[ranges_index].lazy, \ + skip_ifunc); \ + if ((pass) != DL_RELOC_NORMAL) \ for (int ranges_index = 0; ranges_index < 2; ++ranges_index) \ elf_dynamic_do_##reloc##_irelative ((map), scope, \ ranges[ranges_index].start, \ @@ -158,7 +164,8 @@ enum elf_dynamic_reloc_phase ranges[ranges_index].start, \ ranges[ranges_index].size, \ ranges[ranges_index].nrelative, \ - ranges[ranges_index].lazy); \ + ranges[ranges_index].lazy, \ + skip_ifunc); \ } while (0) # if ELF_MACHINE_NO_REL || ELF_MACHINE_NO_RELA @@ -169,37 +176,21 @@ enum elf_dynamic_reloc_phase # if ! ELF_MACHINE_NO_REL # include "do-rel.h" -# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc) \ - _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_BOTH) -# define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy) \ - _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, 0, \ - _ELF_CHECK_REL, DL_RELOC_NOIFUNC) -# define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc) \ +# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass) \ _ELF_DYNAMIC_DO_RELOC (REL, Rel, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_IFUNC) + _ELF_CHECK_REL, pass) # else -# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_REL_NOIFUNC(map, scope, lazy) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_REL_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing. */ +# define ELF_DYNAMIC_DO_REL(map, scope, lazy, skip_ifunc, pass) /* Nothing. */ # endif # if ! ELF_MACHINE_NO_RELA # define DO_RELA # include "do-rel.h" -# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc) \ - _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_BOTH) -# define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy) \ - _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, 0, \ - _ELF_CHECK_REL, DL_RELOC_NOIFUNC) -# define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) \ +# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass) \ _ELF_DYNAMIC_DO_RELOC (RELA, Rela, map, scope, lazy, skip_ifunc, \ - _ELF_CHECK_REL, DL_RELOC_IFUNC) + _ELF_CHECK_REL, pass) # else -# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_RELA_NOIFUNC(map, scope, lazy) /* Nothing to do. */ -# define ELF_DYNAMIC_DO_RELA_IFUNCONLY(map, scope, lazy, skip_ifunc) /* Nothing. */ +# define ELF_DYNAMIC_DO_RELA(map, scope, lazy, skip_ifunc, pass) /* Nothing. */ # endif # define ELF_DYNAMIC_DO_RELR(map) \ @@ -240,37 +231,33 @@ enum elf_dynamic_reloc_phase # else # define DO_RTLD_BOOTSTRAP 0 # endif -# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \ - do { \ - int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ - (consider_profile)); \ - if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ - ELF_DYNAMIC_DO_RELR (map); \ - ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc); \ - ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc); \ - ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy)); \ - } while (0) +/* Perform one relocation pass over MAP. PASS selects which relocations are + processed. It is orthogonal to SKIP_IFUNC, which suppresses running IFUNC + resolvers in whichever pass is selected. -/* Like ELF_DYNAMIC_RELOCATE but only processes the non-IRELATIVE pass. - The IRELATIVE pass must be completed later via ELF_DYNAMIC_RELOCATE_IFUNC. - Used by the static-pie startup so the TCB and stack-protector canary can - be initialised between the two passes. */ -# define ELF_DYNAMIC_RELOCATE_NOIFUNC(map, scope, lazy, consider_profile) \ + Unless PASS is DL_RELOC_IRELATIVE, this also performs the machine-specific + PLT/GOT setup, the DT_RELR relocations, and the ELF_DYNAMIC_AFTER_RELOC + hook. */ +# define ELF_DYNAMIC_RELOCATE_PASS(pass, map, scope, lazy, consider_profile, \ + skip_ifunc) \ do { \ - int edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ + int edr_lazy = (lazy); \ + if ((pass) != DL_RELOC_IRELATIVE) \ + { \ + edr_lazy = elf_machine_runtime_setup ((map), (scope), (lazy), \ (consider_profile)); \ - if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ - ELF_DYNAMIC_DO_RELR (map); \ - ELF_DYNAMIC_DO_REL_NOIFUNC ((map), (scope), edr_lazy); \ - ELF_DYNAMIC_DO_RELA_NOIFUNC ((map), (scope), edr_lazy); \ - ELF_DYNAMIC_AFTER_RELOC ((map), (edr_lazy)); \ + if (!is_rtld_link_map (map) || DO_RTLD_BOOTSTRAP) \ + ELF_DYNAMIC_DO_RELR (map); \ + } \ + ELF_DYNAMIC_DO_REL ((map), (scope), edr_lazy, skip_ifunc, (pass)); \ + ELF_DYNAMIC_DO_RELA ((map), (scope), edr_lazy, skip_ifunc, (pass)); \ + if ((pass) != DL_RELOC_IRELATIVE) \ + ELF_DYNAMIC_AFTER_RELOC ((map), edr_lazy); \ } while (0) -/* IRELATIVE-only companion to ELF_DYNAMIC_RELOCATE_NOIFUNC. */ -# define ELF_DYNAMIC_RELOCATE_IFUNC(map, scope, lazy, skip_ifunc) \ - do { \ - ELF_DYNAMIC_DO_REL_IFUNCONLY ((map), (scope), (lazy), skip_ifunc); \ - ELF_DYNAMIC_DO_RELA_IFUNCONLY ((map), (scope), (lazy), skip_ifunc); \ - } while (0) +/* Run both passes back to back, for callers with nothing to interleave. */ +# define ELF_DYNAMIC_RELOCATE(map, scope, lazy, consider_profile, skip_ifunc) \ + ELF_DYNAMIC_RELOCATE_PASS (DL_RELOC_ALL, (map), (scope), (lazy), \ + (consider_profile), skip_ifunc) #endif diff --git a/elf/tst-ifunc-fault-dep-bindnow.c b/elf/tst-ifunc-fault-dep-bindnow.c new file mode 100644 index 0000000000..60d97dcaa4 --- /dev/null +++ b/elf/tst-ifunc-fault-dep-bindnow.c @@ -0,0 +1,19 @@ +/* Program calling an IFUNC defined in a dependency. BIND_NOW variant. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include "tst-ifunc-fault-dep-lazy.c" diff --git a/elf/tst-ifunc-fault-dep-lazy.c b/elf/tst-ifunc-fault-dep-lazy.c new file mode 100644 index 0000000000..122d33f391 --- /dev/null +++ b/elf/tst-ifunc-fault-dep-lazy.c @@ -0,0 +1,27 @@ +/* Program calling an IFUNC defined in a dependency (BZ 34428). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +extern void magic (void); + +int +main (void) +{ + /* JMP_SLOT relocation against an undefined symbol. */ + magic (); + return 1; +} diff --git a/elf/tst-ifunc-fault-mod.c b/elf/tst-ifunc-fault-mod.c new file mode 100644 index 0000000000..11c21b48ac --- /dev/null +++ b/elf/tst-ifunc-fault-mod.c @@ -0,0 +1,38 @@ +/* Shared object exporting an IFUNC symbol with a resolver which crashes. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +static void +implementation (void) +{ + /* Produce a crash, without depending on any relocations. */ + volatile char *volatile p = NULL; + *p = 0; +} + +static __typeof__ (implementation) * +resolver (void) +{ + /* Produce a crash, without depending on any relocations. */ + volatile char *volatile p = NULL; + *p = 0; + return implementation; +} + +void magic (void) __attribute__ ((ifunc ("resolver"))); commit afd131806b25715a7617ab757db43f0bb610acbf Author: Adhemerval Zanella Date: Wed Aug 12 09:03:17 2026 -0300 m68k: Fix fmod/fmodf infinite recursion (BZ 34508) Commits 6deadd4eb6a and ade9f30ce27 changed m68k fmod to call __m81_u(fmod), instead of the mathimpl.h inline __m81_u(__ieee754_fmod) (that wraps the m68k fmod instruction). This leads to infinite recursion. Tested-by: John Paul Adrian Glaubitz (cherry picked from commit bb213471bedc177b8efd3178584137fb81cc976a) diff --git a/NEWS b/NEWS index d0ef2d3e9a..697049efd1 100644 --- a/NEWS +++ b/NEWS @@ -18,6 +18,8 @@ The following bugs are resolved with this release: [34441] math: math: sinh() returns wrong results for some inputs with |x| > 36.736801 [34465] math: math: x86_64 tanh ifunc selection wrong + [34509] libc: [m68k] Regression: Perl locks up after upgrading glibc + to 2.43 Version 2.44 diff --git a/sysdeps/m68k/m680x0/fpu/e_fmod.c b/sysdeps/m68k/m680x0/fpu/e_fmod.c index 9ad6924422..faac7c79e3 100644 --- a/sysdeps/m68k/m680x0/fpu/e_fmod.c +++ b/sysdeps/m68k/m680x0/fpu/e_fmod.c @@ -33,7 +33,7 @@ __fmod (double x, double y) && !is_nan (hx))) return __math_invalid (x); - return __m81_u(fmod)(x, y); + return __m81_u(__ieee754_fmod)(x, y); } strong_alias (__fmod, __ieee754_fmod) libm_alias_finite (__ieee754_fmod, __fmod) diff --git a/sysdeps/m68k/m680x0/fpu/e_fmodf.c b/sysdeps/m68k/m680x0/fpu/e_fmodf.c index a3bd24b71f..98797e0887 100644 --- a/sysdeps/m68k/m680x0/fpu/e_fmodf.c +++ b/sysdeps/m68k/m680x0/fpu/e_fmodf.c @@ -34,7 +34,7 @@ __fmodf (float x, float y) && !is_nan (hx))) return __math_invalidf (x); - return __m81_u(fmodf)(x, y); + return __m81_u(__ieee754_fmodf)(x, y); } strong_alias (__fmodf, __ieee754_fmodf) versioned_symbol (libm, __fmodf, fmodf, GLIBC_2_43); commit d6ff274313d79feb864cc10eb775b91c817a67e9 Author: Florian Weimer Date: Fri Aug 14 13:41:16 2026 +0200 misc: Fix out-of-bounds array write in tdelete (bug 34506) Allocate the maximum array sizes directly, instead of resizing the arrays as needed. This eliminates alloca usage from the function, and fixes the out-of-bounds accesses. The asserts guard against the bug coming back if the balancing of the tree turns out not to work correctly. Reviewed-by: Adhemerval Zanella (cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3) diff --git a/misc/tsearch.c b/misc/tsearch.c index 9b2eb34b25..e517dfa712 100644 --- a/misc/tsearch.c +++ b/misc/tsearch.c @@ -85,6 +85,7 @@ #include #include #include +#include #include #include #include @@ -406,12 +407,13 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) int cmp; node *rootp = (node *) vrootp; node root, unchained; - /* Stack of nodes so we remember the parents without recursion. It's - _very_ unlikely that there are paths longer than 40 nodes. The tree - would need to have around 250.000 nodes. */ - int stacksize = 40; + /* Stack of nodes so we remember the parents without recursion. The + stack size is a conservative approximation of the maximum height + of a red-black tree, based on size of the address space. + Actual numbers are closer to 57 (32 bit) and 117 (63 bit). */ + enum { stacksize = 2 * UINTPTR_WIDTH }; int sp = 0; - node **nodestack = alloca (sizeof (node *) * stacksize); + node *nodestack[stacksize]; if (rootp == NULL) return NULL; @@ -424,14 +426,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) root = DEREFNODEPTR(rootp); while ((cmp = (*compar) (key, root->key)) != 0) { - if (sp == stacksize) - { - node **newstack; - stacksize += 20; - newstack = alloca (sizeof (node *) * stacksize); - nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); - } - + assert (sp < stacksize); nodestack[sp++] = rootp; p = DEREFNODEPTR(rootp); if (cmp < 0) @@ -470,13 +465,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) node upn; for (;;) { - if (sp == stacksize) - { - node **newstack; - stacksize += 20; - newstack = alloca (sizeof (node *) * stacksize); - nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); - } + assert (sp < stacksize); nodestack[sp++] = parentp; parentp = up; upn = DEREFNODEPTR(up); @@ -541,6 +530,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) SETNODEPTR(pp,q); /* Make sure pp is right if the case below tries to use it. */ + assert (sp < stacksize); nodestack[sp++] = pp = LEFTPTR(q); q = RIGHT(p); } @@ -625,6 +615,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) SETLEFT(p,RIGHT(q)); SETRIGHT(q,p); SETNODEPTR(pp,q); + assert (sp < stacksize); nodestack[sp++] = pp = RIGHTPTR(q); q = LEFT(p); } commit ae9225d55963c4420c49ccfa3f2fafc416f92032 Author: Andreas Schwab Date: Mon Aug 24 18:00:26 2026 +0200 m68k: remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c (bug 34559) This was missed from commit 6deadd4eb6. (cherry picked from commit ff1c5580610dee6d743169fc0f6684505d372dc9) diff --git a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c b/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c deleted file mode 100644 index 57f38091e6..0000000000 --- a/sysdeps/m68k/m680x0/fpu/w_fmod_compat.c +++ /dev/null @@ -1,15 +0,0 @@ -/* m68k provides an optimized __ieee752_fmod. */ -#include -#ifdef SHARED -# undef SHLIB_COMPAT -# define SHLIB_COMPAT(a, b, c) 1 -# undef LIBM_SVID_COMPAT -# define LIBM_SVID_COMPAT 1 -# undef compat_symbol -# define compat_symbol(a, b, c, d) -#include -libm_alias_double (__fmod_compat, fmod) -#else -#include -#include -#endif