aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2024-04-25CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)Florian Weimer1-2/+3
Using alloca matches what other caches do. The request length is bounded by MAXKEYLEN. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa)
2024-04-25x86: Define MINIMUM_X86_ISA_LEVEL in config.h [BZ #31676]H.J. Lu4-1/+18
Define MINIMUM_X86_ISA_LEVEL at configure time to avoid /usr/bin/ld: …/build/elf/librtld.os: in function `init_cpu_features': …/git/elf/../sysdeps/x86/cpu-features.c:1202: undefined reference to `_dl_runtime_resolve_fxsave' /usr/bin/ld: …/build/elf/librtld.os: relocation R_X86_64_PC32 against undefined hidden symbol `_dl_runtime_resolve_fxsave' can not be used when making a shared object /usr/bin/ld: final link failed: bad value collect2: error: ld returned 1 exit status when glibc is built with -march=x86-64-v3 and configured with --with-rtld-early-cflags=-march=x86-64, which is used to allow ld.so to print an error message on unsupported CPUs: Fatal glibc error: CPU does not support x86-64-v3 This fixes BZ #31676. Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com> (cherry picked from commit 46c999741340ea559784c20a45077955b50aca43)
2024-04-25i386: ulp update for SSE2 --disable-multi-arch configurationsFlorian Weimer1-0/+1
(cherry picked from commit 3a3a4497421422aa854c855cbe5110ca7d598ffc)
2024-04-25nptl: Fix tst-cancel30 on kernels without ppoll_time64 supportFlorian Weimer1-4/+11
Fall back to ppoll if ppoll_time64 fails with ENOSYS. Fixes commit 370da8a121c3ba9eeb2f13da15fc0f21f4136b25 ("nptl: Fix tst-cancel30 on sparc64"). Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit f4724843ada64a51d66f65d3199fe431f9d4c254)
2024-04-17iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence ↵Charles Fol3-1/+144
(CVE-2024-2961) ISO-2022-CN-EXT uses escape sequences to indicate character set changes (as specified by RFC 1922). While the SOdesignation has the expected bounds checks, neither SS2designation nor SS3designation have its; allowing a write overflow of 1, 2, or 3 bytes with fixed values: '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. Checked on aarch64-linux-gnu. Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada)
2024-04-14x86_64: Exclude SSE, AVX and FMA4 variants in libm multiarchSunil K Pandey62-295/+953
When glibc is built with ISA level 3 or higher by default, the resulting glibc binaries won't run on SSE or FMA4 processors. Exclude SSE, AVX and FMA4 variants in libm multiarch when ISA level 3 or higher is enabled by default. When glibc is built with ISA level 2 enabled by default, only keep SSE4.1 variant. Fixes BZ 31335. NB: elf/tst-valgrind-smoke test fails with ISA level 4, because valgrind doesn't support AVX512 instructions: https://bugs.kde.org/show_bug.cgi?id=383010 Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 9f78a7c1d0963282608da836b840f0d5ae1c478e)
2024-04-14Apply the Makefile sorting fixH.J. Lu5-57/+57
Apply the Makefile sorting fix generated by sort-makefile-lines.py. (cherry picked from commit ef7f4b1fef67430a8f3cfc77fa6aada2add851d7)
2024-04-14powerpc: Fix ld.so address determination for PCREL mode (bug 31640)Florian Weimer1-0/+19
This seems to have stopped working with some GCC 14 versions, which clobber r2. With other compilers, the kernel-provided r2 value is still available at this point. Reviewed-by: Peter Bergner <bergner@linux.ibm.com> (cherry picked from commit 14e56bd4ce15ac2d1cc43f762eb2e6b83fec1afe)
2024-04-13x86-64: Simplify minimum ISA check ifdef conditional with ifSunil K Pandey1-11/+8
Replace minimum ISA check ifdef conditional with if. Since MINIMUM_X86_ISA_LEVEL and AVX_X86_ISA_LEVEL are compile time constants, compiler will perform constant folding optimization, getting same results. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit b6e3898194bbae78910bbe9cd086937014961e45)
2024-04-13x86-64: Don't use SSE resolvers for ISA level 3 or aboveH.J. Lu2-12/+20
When glibc is built with ISA level 3 or above enabled, SSE resolvers aren't available and glibc fails to build: ld: .../elf/librtld.os: in function `init_cpu_features': .../elf/../sysdeps/x86/cpu-features.c:1200:(.text+0x1445f): undefined reference to `_dl_runtime_resolve_fxsave' ld: .../elf/librtld.os: relocation R_X86_64_PC32 against undefined hidden symbol `_dl_runtime_resolve_fxsave' can not be used when making a shared object /usr/local/bin/ld: final link failed: bad value For ISA level 3 or above, don't use _dl_runtime_resolve_fxsave nor _dl_tlsdesc_dynamic_fxsave. This fixes BZ #31429. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com> (cherry picked from commit befe2d3c4dec8be2cdd01a47132e47bdb7020922)
2024-04-09AArch64: Check kernel version for SVE ifuncsWilco Dijkstra5-2/+53
Old Linux kernels disable SVE after every system call. Calling the SVE-optimized memcpy afterwards will then cause a trap to reenable SVE. As a result, applications with a high use of syscalls may run slower with the SVE memcpy. This is true for kernels between 4.15.0 and before 6.2.0, except for 5.14.0 which was patched. Avoid this by checking the kernel version and selecting the SVE ifunc on modern kernels. Parse the kernel version reported by uname() into a 24-bit kernel.major.minor value without calling any library functions. If uname() is not supported or if the version format is not recognized, assume the kernel is modern. Tested-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 2e94e2f5d2bf2de124c8ad7da85463355e54ccb2)
2024-04-09aarch64: fix check for SVE support in assemblerSzabolcs Nagy2-4/+6
Due to GCC bug 110901 -mcpu can override -march setting when compiling asm code and thus a compiler targetting a specific cpu can fail the configure check even when binutils gas supports SVE. The workaround is that explicit .arch directive overrides both -mcpu and -march, and since that's what the actual SVE memcpy uses the configure check should use that too even if the GCC issue is fixed independently. Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 73c26018ed0ecd9c807bb363cc2c2ab4aca66a82)
2024-04-09aarch64/fpu: Sync libmvec routines from 2.39 and before with AORJoe Ramsay18-105/+111
This includes a fix for big-endian in AdvSIMD log, some cosmetic changes, and numerous small optimisations mainly around inlining and using indexed variants of MLA intrinsics. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit e302e1021391d13a9611ba3a910df128830bd19e)
2024-04-07i386: Use generic memrchr in libc (bug 31316)Florian Weimer2-1/+1
Before this change, we incorrectly used the SSE2 variant in the implementation, without checking that the system actually supports SSE2. Tested-by: Sam James <sam@gentoo.org> (cherry picked from commit 0d9166c2245cad4ac520b337dee40c9a583872b6)
2024-04-04x86: Expand the comment on when REP STOSB is used on memsetAdhemerval Zanella1-1/+3
Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 491e55beab7457ed310a4a47496f4a333c5d1032)
2024-04-04x86: Do not prefer ERMS for memset on Zen3+Adhemerval Zanella1-0/+5
For AMD Zen3+ architecture, the performance of the vectorized loop is slightly better than ERMS. Checked on x86_64-linux-gnu on Zen3. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 272708884cb750f12f5c74a00e6620c19dc6d567)
2024-04-04x86: Fix Zen3/Zen4 ERMS selection (BZ 30994)Adhemerval Zanella1-20/+18
The REP MOVSB usage on memcpy/memmove does not show much performance improvement on Zen3/Zen4 cores compared to the vectorized loops. Also, as from BZ 30994, if the source is aligned and the destination is not the performance can be 20x slower. The performance difference is noticeable with small buffer sizes, closer to the lower bounds limits when memcpy/memmove starts to use ERMS. The performance of REP MOVSB is similar to vectorized instruction on the size limit (the L2 cache). Also, there is no drawback to multiple cores sharing the cache. Checked on x86_64-linux-gnu on Zen3. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 0c0d39fe4aeb0f69b26e76337c5dfd5530d5d44e)
2024-04-02Add tst-gnu2-tls2mod1 to test-internal-extrasAndreas Schwab1-0/+2
That allows sysdeps/x86_64/tst-gnu2-tls2mod1.S to use internal headers. Fixes: 717ebfa85c ("x86-64: Allocate state buffer space for RDI, RSI and RBX") (cherry picked from commit fd7ee2e6c5eb49e4a630a9978b4d668bff6354ee)
2024-04-01elf: Enable TLS descriptor tests on aarch64Adhemerval Zanella5-33/+40
The aarch64 uses 'trad' for traditional tls and 'desc' for tls descriptors, but unlike other targets it defaults to 'desc'. The gnutls2 configure check does not set aarch64 as an ABI that uses TLS descriptors, which then disable somes stests. Also rename the internal machinery fron gnu2 to tls descriptors. Checked on aarch64-linux-gnu. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 3d53d18fc71c5d9ef4773b8bce04d54b80181926)
2024-04-01arm: Update _dl_tlsdesc_dynamic to preserve caller-saved registers (BZ 31372)Adhemerval Zanella10-15/+250
ARM _dl_tlsdesc_dynamic slow path has two issues: * The ip/r12 is defined by AAPCS as a scratch register, and gcc is used to save the stack pointer before on some function calls. So it should also be saved/restored as well. It fixes the tst-gnu2-tls2. * None of the possible VFP registers are saved/restored. ARM has the additional complexity to have different VFP bank sizes (depending of VFP support by the chip). The tst-gnu2-tls2 test is extended to check for VFP registers, although only for hardfp builds. Different than setcontext, _dl_tlsdesc_dynamic does not have HWCAP_ARM_IWMMXT (I don't have a way to properly test it and it is almost a decade since newer hardware was released). With this patch there is no need to mark tst-gnu2-tls2 as XFAIL. Checked on arm-linux-gnueabihf. Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 64c7e344289ed085517c2227d8e3b06388242c13)
2024-04-01Ignore undefined symbols for -mtls-dialect=gnu2Adhemerval Zanella2-2/+2
So it does not fail for arm config that defaults to -mtp=soft (which issues a call to __aeabi_read_tp). Reviewed-by: H.J. Lu <hjl.tools@gmail.com> (cherry picked from commit 968b0ca9440040a2b31248a572891f0e55c1ab10)
2024-04-01x86-64: Allocate state buffer space for RDI, RSI and RBXH.J. Lu3-11/+147
_dl_tlsdesc_dynamic preserves RDI, RSI and RBX before realigning stack. After realigning stack, it saves RCX, RDX, R8, R9, R10 and R11. Define TLSDESC_CALL_REGISTER_SAVE_AREA to allocate space for RDI, RSI and RBX to avoid clobbering saved RDI, RSI and RBX values on stack by xsave to STATE_SAVE_OFFSET(%rsp). +==================+<- stack frame start aligned at 8 or 16 bytes | |<- RDI saved in the red zone | |<- RSI saved in the red zone | |<- RBX saved in the red zone | |<- paddings for stack realignment of 64 bytes |------------------|<- xsave buffer end aligned at 64 bytes | |<- | |<- | |<- |------------------|<- xsave buffer start at STATE_SAVE_OFFSET(%rsp) | |<- 8-byte padding for 64-byte alignment | |<- 8-byte padding for 64-byte alignment | |<- R11 | |<- R10 | |<- R9 | |<- R8 | |<- RDX | |<- RCX +==================+<- RSP aligned at 64 bytes Define TLSDESC_CALL_REGISTER_SAVE_AREA, the total register save area size for all integer registers by adding 24 to STATE_SAVE_OFFSET since RDI, RSI and RBX are saved onto stack without adjusting stack pointer first, using the red-zone. This fixes BZ #31501. Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com> (cherry picked from commit 717ebfa85c8240d32d0d19d86a484c31c55c9617)
2024-04-01x86-64: Update _dl_tlsdesc_dynamic to preserve AMX registersH.J. Lu14-6/+299
_dl_tlsdesc_dynamic should also preserve AMX registers which are caller-saved. Add X86_XSTATE_TILECFG_ID and X86_XSTATE_TILEDATA_ID to x86-64 TLSDESC_CALL_STATE_SAVE_MASK. Compute the AMX state size and save it in xsave_state_full_size which is only used by _dl_tlsdesc_dynamic_xsave and _dl_tlsdesc_dynamic_xsavec. This fixes the AMX part of BZ #31372. Tested on AMX processor. AMX test is enabled only for compilers with the fix for https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114098 GCC 14 and GCC 11/12/13 branches have the bug fix. Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com> (cherry picked from commit 9b7091415af47082664717210ac49d51551456ab)
2024-04-01x86: Update _dl_tlsdesc_dynamic to preserve caller-saved registersH.J. Lu24-213/+920
Compiler generates the following instruction sequence for GNU2 dynamic TLS access: leaq tls_var@TLSDESC(%rip), %rax call *tls_var@TLSCALL(%rax) or leal tls_var@TLSDESC(%ebx), %eax call *tls_var@TLSCALL(%eax) CALL instruction is transparent to compiler which assumes all registers, except for EFLAGS and RAX/EAX, are unchanged after CALL. When _dl_tlsdesc_dynamic is called, it calls __tls_get_addr on the slow path. __tls_get_addr is a normal function which doesn't preserve any caller-saved registers. _dl_tlsdesc_dynamic saved and restored integer caller-saved registers, but didn't preserve any other caller-saved registers. Add _dl_tlsdesc_dynamic IFUNC functions for FNSAVE, FXSAVE, XSAVE and XSAVEC to save and restore all caller-saved registers. This fixes BZ #31372. Add GLRO(dl_x86_64_runtime_resolve) with GLRO(dl_x86_tlsdesc_dynamic) to optimize elf_machine_runtime_setup. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com> (cherry picked from commit 0aac205a814a8511e98d02b91a8dc908f1c53cde)
2024-04-01x86-64: Save APX registers in ld.so trampolineH.J. Lu1-6/+46
Add APX registers to STATE_SAVE_MASK so that APX registers are saved in ld.so trampoline. This fixes BZ #31371. Also update STATE_SAVE_OFFSET and STATE_SAVE_MASK for i386 which will be used by i386 _dl_tlsdesc_dynamic. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com> (cherry picked from commit dfb05f8e704edac70db38c4c8ee700769d91a413)
2024-03-22LoongArch: Correct {__ieee754, _}_scalb -> {__ieee754, _}_scalbfcaiyinyu1-1/+1
2024-03-20powerpc: Placeholder and infrastructure/build support to add Power11 ↵Amrita H S15-5/+27
related changes. The following three changes have been added to provide initial Power11 support. 1. Add the directories to hold Power11 files. 2. Add support to select Power11 libraries based on AT_PLATFORM. 3. Let submachine=power11 be set automatically. Reviewed-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Peter Bergner <bergner@linux.ibm.com> (cherry picked from commit 1ea051145612f199d8716ecdf78b084b00b5a727)
2024-03-20powerpc: Add HWCAP3/HWCAP4 data to TCB for Power Architecture.Manjunath Matti12-19/+74
This patch adds a new feature for powerpc. In order to get faster access to the HWCAP3/HWCAP4 masks, similar to HWCAP/HWCAP2 (i.e. for implementing __builtin_cpu_supports() in GCC) without the overhead of reading them from the auxiliary vector, we now reserve space for them in the TCB. Suggested-by: Peter Bergner <bergner@linux.ibm.com> Reviewed-by: Peter Bergner <bergner@linux.ibm.com> (cherry picked from commit 3ab9b88e2ac91062b6d493fe32bd101a55006c6a)
2024-03-18linux: Use rseq area unconditionally in sched_getcpu (bug 31479)Florian Weimer1-8/+0
Originally, nptl/descr.h included <sys/rseq.h>, but we removed that in commit 2c6b4b272e6b4d07303af25709051c3e96288f2d ("nptl: Unconditionally use a 32-byte rseq area"). After that, it was not ensured that the RSEQ_SIG macro was defined during sched_getcpu.c compilation that provided a definition. This commit always checks the rseq area for CPU number information before using the other approaches. This adds an unnecessary (but well-predictable) branch on architectures which do not define RSEQ_SIG, but its cost is small compared to the system call. Most architectures that have vDSO acceleration for getcpu also have rseq support. Fixes: 2c6b4b272e6b4d07303af25709051c3e96288f2d Fixes: 1d350aa06091211863e41169729cee1bca39f72f Reviewed-by: Arjun Shankar <arjun@redhat.com> (cherry picked from commit 7a76f218677d149d8b7875b336722108239f7ee9)
2024-03-04Use gcc __builtin_stdc_* builtins in stdbit.h if possibleJakub Jelinek4-15/+856
The following patch uses the GCC 14 __builtin_stdc_* builtins in stdbit.h for the type-generic macros, so that when compiled with GCC 14 or later, it supports not just 8/16/32/64-bit unsigned integers, but also 128-bit (if target supports them) and unsigned _BitInt (any supported precision). And so that the macros don't expand arguments multiple times and can be evaluated in constant expressions. The new testcase is gcc's gcc/testsuite/gcc.dg/builtin-stdc-bit-1.c adjusted to test stdbit.h and the type-generic macros in there instead of the builtins and adjusted to use glibc test framework rather than gcc style tests with __builtin_abort (). Signed-off-by: Jakub Jelinek <jakub@redhat.com> Reviewed-by: Joseph Myers <josmyers@redhat.com> (cherry picked from commit da89496337b97e6a2aaf1e81d55cf998f6db1070)
2024-02-27S390: Do not clobber r7 in clone [BZ #31402]Stefan Liebler3-12/+63
Starting with commit e57d8fc97b90127de4ed3e3a9cdf663667580935 "S390: Always use svc 0" clone clobbers the call-saved register r7 in error case: function or stack is NULL. This patch restores the saved registers also in the error case. Furthermore the existing test misc/tst-clone is extended to check all error cases and that clone does not clobber registers in this error case. (cherry picked from commit 02782fd12849b6673cb5c2728cb750e8ec295aa3)
2024-02-22math: Update mips64 ulpsXi Ruoyao1-3/+4
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org> (cherry picked from commit e2a65ecc4b30a797df7dc6529f09b712aa256029)
2024-02-12mips: FIx clone3 implementation (BZ 31325)Adhemerval Zanella1-5/+27
For o32 we need to setup a minimal stack frame to allow cprestore on __thread_start_clone3 (which instruct the linker to save the gp for PIC). Also, there is no guarantee by kABI that $8 will be preserved after syscall execution, so we need to save it on the provided stack. Checked on mipsel-linux-gnu. Reported-by: Khem Raj <raj.khem@gmail.com> Tested-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bbd248ac0d75efdef8fe61ea69b1fb25fb95b6e7)
2024-02-05arm: Remove wrong ldr from _dl_start_user (BZ 31339)Adhemerval Zanella1-1/+0
The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove _dl_skip_args usage) removed the _SKIP_ARGS literal, which was previously loader to r4 on loader _start. However, the cleanup did not remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check to skip the arguments after ld self-relocations. In my testing, the kernel initially set r4 to 0, which makes the ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4 is a callee-saved register; a different runtime might not zero initialize it and thus trigger an invalid memory access. Checked on arm-linux-gnu. Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com> Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a)
2024-01-31Replace advisories directoryAndreas K. Hüttel10-194/+2
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-31Create ChangeLog.old/ChangeLog.28glibc-2.39Andreas K. Hüttel1-0/+8505
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-31version.h, include/features.h: Bump version to 2.39Andreas K. Hüttel2-3/+3
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-31po: Update translationsAndreas K. Hüttel38-845/+694
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-31libc.pot: regenerateAndreas K. Hüttel1-31/+26
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-31INSTALL, install.texi: minor updates, regenerateAndreas K. Hüttel2-6/+6
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30contrib.texi: updateAndreas K. Hüttel1-8/+24
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30NEWS: insert advisories and fixed bugs for 2.39Andreas K. Hüttel1-4/+133
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30S390: Fix building with --disable-mutli-arch [BZ #31196]Stefan Liebler2-2/+6
Starting with commits - 7ea510127e2067efa07865158ac92c330c379950 string: Add libc_hidden_proto for strchrnul - 22999b2f0fb62eed1af4095d062bd1272d6afeb1 string: Add libc_hidden_proto for memrchr building glibc on s390x with --disable-multi-arch fails if only the C-variant of strchrnul / memrchr is used. This is the case if gcc uses -march < z13. The build fails with: ../sysdeps/s390/strchrnul-c.c:28:49: error: ‘__strchrnul_c’ undeclared here (not in a function); did you mean ‘__strchrnul’? 28 | __hidden_ver1 (__strchrnul_c, __GI___strchrnul, __strchrnul_c); With --disable-multi-arch, __strchrnul_c is not available as string/strchrnul.c is just included without defining STRCHRNUL and thus we also don't have to create the internal hidden symbol. Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30Fix typoAndreas K. Hüttel1-1/+1
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30manual/io: Fix swapped reading and writing phrase.Joe Simmons-Talbott1-1/+1
Reviewed-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30Update advisory format and introduce some automationSiddhesh Poyarekar8-67/+182
Simplify the advisory format by dropping the -Backport tags and instead stick to using just the -Commit tags. To identify backports, put a substring of git-describe into the release version in the brackets next to the commit ref. This way, it not only identifies that the fix (or regression) is on the release/2.YY/master branch, it also disambiguates regressions/fixes in the branch from those in the tarball. Add a README to make it easier for consumers to understand the format. Additionally, the Release wiki needs to be updated to inform the release manager to: 1. Generate a NEWS snipped from the advisories directory AND 2. on release/2.YY/master, replace the advisories directory with a text file pointing to the advisories directory in master so that we don't have to update multiple locations. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Andreas K. Hüttel <dilfridge@gentoo.org>
2024-01-30Document CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780Arjun Shankar3-0/+43
This commit adds "advisories" entries for the above three CVEs.
2024-01-30syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)Arjun Shankar1-1/+2
__vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. This commit fixes that. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
2024-01-30syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)Arjun Shankar1-11/+28
__vsyslog_internal used the return value of snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these functions (for any reason) failed and returned -1, the resulting buffer would be too small to hold output. This commit fixes that. All snprintf/vsnprintf calls are checked for negative return values and the function silently returns upon encountering them. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
2024-01-30syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)Arjun Shankar4-15/+82
__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER containing a long program name failed to update the required buffer size, leading to the allocation and overflow of a too-small buffer on the heap. This commit fixes that. It also adds a new regression test that uses glibc.malloc.check. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>