Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package glibc for openSUSE:Factory checked in at 2026-06-28 21:04:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/glibc (Old) and /work/SRC/openSUSE:Factory/.glibc.new.11887 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glibc" Sun Jun 28 21:04:46 2026 rev:306 rq:1361545 version:2.43 Changes: -------- --- /work/SRC/openSUSE:Factory/glibc/glibc.changes 2026-05-13 17:18:20.612811807 +0200 +++ /work/SRC/openSUSE:Factory/.glibc.new.11887/glibc.changes 2026-06-28 21:04:48.622589215 +0200 @@ -1,0 +2,28 @@ +Mon Jun 22 10:30:37 UTC 2026 - Andreas Schwab <[email protected]> + +- resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in + ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033) +- resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop + failure in ns_sprintrrf +- resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in + ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069) + +------------------------------------------------------------------- +Thu Jun 18 08:52:18 UTC 2026 - Andreas Schwab <[email protected]> + +- fma-shift-ub.patch: math: Fix fma alignment when exponent difference is + exactly 64 (BZ #34183) +- struct-reserved-members.patch: Rename __unused fields to + __glibc_reserved +- iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate + errors with //TRANSLIT (BZ #34236) +- arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT + trampolines (BZ #34144, BZ #15792) + +------------------------------------------------------------------- +Fri May 22 14:27:38 UTC 2026 - Marcus Meissner <[email protected]> + +- filter use of -fhardened (gcc switch that selects multiple + hardening options) + +------------------------------------------------------------------- New: ---- arm-vfp-plt-trampoline.patch fma-shift-ub.patch iconv-translit-intermediate-errors.patch resolv-sprintrrf-buffer-overreads.patch resolv-sprintrrf-inet-ntop-check.patch resolv-sprintrrf-unkown-types.patch struct-reserved-members.patch ----------(New B)---------- New: errors with //TRANSLIT (BZ #34236) - arm-vfp-plt-trampoline.patch: arm: Save/restore VFP registers in PLT trampolines (BZ #34144, BZ #15792) New: - fma-shift-ub.patch: math: Fix fma alignment when exponent difference is exactly 64 (BZ #34183) New: __glibc_reserved - iconv-translit-intermediate-errors.patch: iconv: Suppress intermediate errors with //TRANSLIT (BZ #34236) New: failure in ns_sprintrrf - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069) New: ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033) - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop failure in ns_sprintrrf New: - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033) New: exactly 64 (BZ #34183) - struct-reserved-members.patch: Rename __unused fields to __glibc_reserved ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ glibc.spec ++++++ --- /var/tmp/diff_new_pack.dYDWCK/_old 2026-06-28 21:04:50.778661865 +0200 +++ /var/tmp/diff_new_pack.dYDWCK/_new 2026-06-28 21:04:50.778661865 +0200 @@ -371,6 +371,20 @@ Patch1015: ungetwc-byte-stream.patch # PATCH-FIX-UPSTREAM stdio-common: Fix buffer overflow in scanf %mc (CVE-2026-5450, BZ #34008) Patch1016: scanf-mc-buffer-overflow.patch +# PATCH-FIX-UPSTREAM math: Fix fma alignment when exponent difference is exactly 64 (BZ #34183) +Patch1017: fma-shift-ub.patch +# PATCH-FIX-UPSTREAM Rename __unused fields to __glibc_reserved +Patch1018: struct-reserved-members.patch +# PATCH-FIX-UPSTREAM iconv: Suppress intermediate errors with //TRANSLIT (BZ #34236) +Patch1019: iconv-translit-intermediate-errors.patch +# PATCH-FIX-UPSTREAM arm: Save/restore VFP registers in PLT trampolines (BZ #34144, BZ #15792) +Patch1020: arm-vfp-plt-trampoline.patch +# PATCH-FIX-UPSTREAM resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435, BZ #34033) +Patch1021: resolv-sprintrrf-unkown-types.patch +# PATCH-FIX-UPSTREAM resolv: Check for inet_ntop failure in ns_sprintrrf +Patch1022: resolv-sprintrrf-inet-ntop-check.patch +# PATCH-FIX-UPSTREAM resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238, BZ #34069) +Patch1023: resolv-sprintrrf-buffer-overreads.patch %endif ### @@ -639,6 +653,7 @@ case $opt in -fstack-protector-*) enable_stack_protector=${opt#-fstack-protector-} ;; -fstack-protector) enable_stack_protector=yes ;; + -fhardened) enable_stack_protector=strong ; enable_fortify_source=3 ;; -D_FORTIFY_SOURCE=*) enable_fortify_source=${opt#-D_FORTIFY_SOURCE=} ;; -ffortify=* | *_FORTIFY_SOURCE*) ;; %if "%flavor" == "i686" ++++++ arm-vfp-plt-trampoline.patch ++++++ >From a6fa9a95949e3a24c09590a61e96f500e9c75c43 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella <[email protected]> Date: Wed, 13 May 2026 08:32:24 -0300 Subject: [PATCH] arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792) _dl_runtime_resolve and _dl_runtime_profile only preserved the integer argument registers (r0-r3) across the inner call to _dl_fixup / _dl_profile_fixup. Two related ABI requirements demand more: * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the function being resolved. Recent GCC emits VFP instructions inside the fixup routines, clobbering them, so the resolved function sees corrupted arguments (BZ 34144). * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers reachable through the dynamic linker) must only corrupt integer core registers. IFUNC resolvers, audit modules, and interposed malloc invoked during symbol resolution may also use VFP, even on softfp ABI builds (BZ 15792). Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31 when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup call. Whether VFP is usable is a property of the hardware, not of the ABI glibc was built with, so the decision is gated on AT_HWCAP at runtime in both hardfp and softfp builds; hardfp builds will always find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU correctly skip the save. For _dl_runtime_profile the save area is slipped in just before the bl to _dl_profile_fixup; the outgoing framesizep argument is recomputed to account for the extra frame, and both the fast path (no audit framesize) and the slow path (audit wraps with pltenter/pltexit) traverse the restore before splitting. Checked on arm-linux-gnueabihf. Tested-by: Aurelien Jarno <[email protected]> Reviewed-by: Wilco Dijkstra <[email protected]> (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972) --- sysdeps/arm/Makefile | 19 +++++ sysdeps/arm/dl-trampoline.S | 110 +++++++++++++++++++++++++++-- sysdeps/arm/tst-bz34144-audit.c | 32 +++++++++ sysdeps/arm/tst-bz34144-auditmod.c | 50 +++++++++++++ sysdeps/arm/tst-bz34144-mod.c | 28 ++++++++ sysdeps/arm/tst-bz34144.c | 32 +++++++++ 6 files changed, 266 insertions(+), 5 deletions(-) create mode 100644 sysdeps/arm/tst-bz34144-audit.c create mode 100644 sysdeps/arm/tst-bz34144-auditmod.c create mode 100644 sysdeps/arm/tst-bz34144-mod.c create mode 100644 sysdeps/arm/tst-bz34144.c diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile index d08dade3c5..0bb1b6e05b 100644 --- a/sysdeps/arm/Makefile +++ b/sysdeps/arm/Makefile @@ -30,6 +30,25 @@ $(objpfx)tst-armtlsdescloc: $(objpfx)tst-armtlsdesclocmod.so $(objpfx)tst-armtlsdescextnow: $(objpfx)tst-armtlsdescextnowmod.so $(objpfx)tst-armtlsdescextlazy: $(objpfx)tst-armtlsdescextlazymod.so endif + +tests += \ + tst-bz34144 \ + tst-bz34144-audit \ + # tests +modules-names += \ + tst-bz34144-auditmod \ + tst-bz34144-mod \ + # modules-names +$(objpfx)tst-bz34144: $(objpfx)tst-bz34144-mod.so +$(objpfx)tst-bz34144-audit: $(objpfx)tst-bz34144-mod.so +$(objpfx)tst-bz34144-audit.out: $(objpfx)tst-bz34144-auditmod.so +# Use lazy binding to check if _dl_runtime_resolve correctly save/restore +# the VFP state. +LDFLAGS-tst-bz34144 = -Wl,-z,lazy +# With LD_AUDIT, lazy resolution goes through _dl_runtime_profile, which +# must also save/restore VFP state (BZ 34144). +LDFLAGS-tst-bz34144-audit = -Wl,-z,lazy +tst-bz34144-audit-ENV = LD_AUDIT=$(objpfx)tst-bz34144-auditmod.so endif endif diff --git a/sysdeps/arm/dl-trampoline.S b/sysdeps/arm/dl-trampoline.S index eb6d464384..88d6824e52 100644 --- a/sysdeps/arm/dl-trampoline.S +++ b/sysdeps/arm/dl-trampoline.S @@ -20,6 +20,7 @@ #define NO_THUMB #include <sysdep.h> #include <libc-symbols.h> +#include <rtld-global-offsets.h> .text .globl _dl_runtime_resolve @@ -36,13 +37,40 @@ _dl_runtime_resolve: @ ip contains &GOT[n+3] (pointer to function) @ lr points to &GOT[2] - @ Save arguments. We save r4 to realign the stack. + @ Save arguments. We save r4 to realign the stack and to hold + @ the hwcap value used to decide whether to save VFP registers. push {r0-r4} cfi_adjust_cfa_offset (20) cfi_rel_offset (r0, 0) cfi_rel_offset (r1, 4) cfi_rel_offset (r2, 8) cfi_rel_offset (r3, 12) + cfi_rel_offset (r4, 16) + +#ifdef SHARED + @ Preserve all call-clobbered VFP registers across _dl_fixup. + @ VFP may be used by IFUNC resolvers, audit modules, interposed + @ malloc, and the __aeabi_mem* helpers required by RTABI32, + @ which mandates that those helpers only corrupt integer core + @ registers. + LDR_GLOBAL (r4, r3, C_SYMBOL_NAME(_rtld_global_ro), \ + RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) + + tst r4, #HWCAP_ARM_VFP + beq .Lno_vfp_save + +# define VFP_STACK_REQ (32*8 + 8) + sub sp, sp, VFP_STACK_REQ + cfi_adjust_cfa_offset (VFP_STACK_REQ) + mov r3, sp + .inst 0xeca30b20 @ vstmia r3!, {d0-d15} + tst r4, #HWCAP_ARM_VFPD32 + beq 1f + .inst 0xece30b20 @ vstmia r3!, {d16-d31} +1: .inst 0xeef12a10 @ vmrs r2, fpscr + str r2, [r3] +.Lno_vfp_save: +#endif /* SHARED */ @ get pointer to linker struct ldr r0, [lr, #-4] @@ -59,8 +87,23 @@ _dl_runtime_resolve: @ save the return mov ip, r0 - @ get arguments and return address back. We restore r4 - @ only to realign the stack. +#ifdef SHARED + tst r4, #HWCAP_ARM_VFP + beq .Lno_vfp_restore + mov r3, sp + .inst 0xecb30b20 @ vldmia r3!, {d0-d15} + tst r4, #HWCAP_ARM_VFPD32 + beq 2f + .inst 0xecf30b20 @ vldmia r3!, {d16-d31} +2: ldr r2, [r3] + .inst 0xeee12a10 @ vmsr fpscr, r2 + add sp, sp, VFP_STACK_REQ + cfi_adjust_cfa_offset (-VFP_STACK_REQ) +.Lno_vfp_restore: +#endif /* SHARED */ + + @ get arguments and return address back. We restore r4 to + @ its original value as well. pop {r0-r4,lr} cfi_adjust_cfa_offset (-24) @@ -124,14 +167,71 @@ _dl_runtime_profile: add r3, sp, #8 stmia r3!, {r0,r1} + @ Preserve all call-clobbered VFP registers across + @ _dl_profile_fixup. See the matching comment in + @ _dl_runtime_resolve above for the rationale (BZ 34144, + @ BZ 15792). + @ + @ Stack layout below the current sp (which becomes the new sp + @ after the sub): + @ sp + 0 .. 3: outgoing arg (framesizep) for _dl_profile_fixup + @ sp + 4 .. 7: saved hwcap (so we can test it after the call) + @ sp + 8 .. 11: saved r2 (used as scratch for LDR_GLOBAL) + @ sp + 12 .. 15: padding (for 8-byte alignment of the VFP area) + @ sp + 16 .. 16+VFP_STACK_REQ-1: VFP regs + fpscr +#define VFP_PROFILE_STACK (16 + VFP_STACK_REQ) + sub sp, sp, #VFP_PROFILE_STACK + cfi_adjust_cfa_offset (VFP_PROFILE_STACK) + + @ r2 holds the retaddr (3rd arg to _dl_profile_fixup); spill + @ it so we can use it as the LDR_GLOBAL destination. + str r2, [sp, #8] + + LDR_GLOBAL (r2, ip, C_SYMBOL_NAME(_rtld_global_ro), \ + RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) + str r2, [sp, #4] + + tst r2, #HWCAP_ARM_VFP + beq .Lprofile_no_vfp_save + add ip, sp, #16 + .inst 0xecac0b20 @ vstmia ip!, {d0-d15} + tst r2, #HWCAP_ARM_VFPD32 + beq 7f + .inst 0xecec0b20 @ vstmia ip!, {d16-d31} +7: .inst 0xeef12a10 @ vmrs r2, fpscr + str r2, [ip] +.Lprofile_no_vfp_save: + + @ Restore r2 (retaddr) for _dl_profile_fixup. + ldr r2, [sp, #8] + @ Set up extra args for _dl_profile_fixup. - @ r2 and r3 are already loaded. - add ip, sp, #208 + @ The framesize slot is at the old sp+208, which is the new + @ sp + VFP_PROFILE_STACK + 208 -- compute in two steps because + @ the combined offset is not encodable as an ARM immediate. + add ip, sp, #VFP_PROFILE_STACK + add ip, ip, #208 str ip, [sp, #0] @ call profiling fixup routine bl _dl_profile_fixup + @ Restore VFP registers. r0 holds the resolved function + @ address; r1/r2/ip are caller-saved by the call. + ldr r1, [sp, #4] + tst r1, #HWCAP_ARM_VFP + beq .Lprofile_no_vfp_restore + add ip, sp, #16 + .inst 0xecbc0b20 @ vldmia ip!, {d0-d15} + tst r1, #HWCAP_ARM_VFPD32 + beq 8f + .inst 0xecfc0b20 @ vldmia ip!, {d16-d31} +8: ldr r2, [ip] + .inst 0xeee12a10 @ vmsr fpscr, r2 +.Lprofile_no_vfp_restore: + add sp, sp, #VFP_PROFILE_STACK + cfi_adjust_cfa_offset (-VFP_PROFILE_STACK) + @ The address to call is now in r0. @ Check whether we're wrapping this function. diff --git a/sysdeps/arm/tst-bz34144-audit.c b/sysdeps/arm/tst-bz34144-audit.c new file mode 100644 index 0000000000..8f1084fa0a --- /dev/null +++ b/sysdeps/arm/tst-bz34144-audit.c @@ -0,0 +1,32 @@ +/* Test that lazy PLT resolution via _dl_runtime_profile preserves + caller-saved VFP registers used to pass double arguments (BZ 34144). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <support/test-driver.h> + +extern void test_float_args (double a, double b, double c, double d, + double e, double f, double g, double h); + +static int +do_test (void) +{ + test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0); + return 0; +} + +#include <support/test-driver.c> diff --git a/sysdeps/arm/tst-bz34144-auditmod.c b/sysdeps/arm/tst-bz34144-auditmod.c new file mode 100644 index 0000000000..ada9f126c2 --- /dev/null +++ b/sysdeps/arm/tst-bz34144-auditmod.c @@ -0,0 +1,50 @@ +/* Minimal audit module used by tst-bz34144-audit to force PLT calls + to go through _dl_runtime_profile instead of _dl_runtime_resolve. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <link.h> +#include <stddef.h> +#include <stdint.h> + +unsigned int +la_version (unsigned int v) +{ + return v; +} + +unsigned int +la_objopen (struct link_map *l, Lmid_t lmid, uintptr_t *cookie) +{ + return LA_FLG_BINDFROM | LA_FLG_BINDTO; +} + +uintptr_t +la_symbind32 (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook, + uintptr_t *defcook, unsigned int *flags, const char *symname) +{ + return sym->st_value; +} + +Elf32_Addr +la_arm_gnu_pltenter (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook, + uintptr_t *defcook, La_arm_regs *regs, + unsigned int *flags, const char *symname, + long int *framesizep) +{ + return sym->st_value; +} diff --git a/sysdeps/arm/tst-bz34144-mod.c b/sysdeps/arm/tst-bz34144-mod.c new file mode 100644 index 0000000000..be6b54bf91 --- /dev/null +++ b/sysdeps/arm/tst-bz34144-mod.c @@ -0,0 +1,28 @@ +/* DSO used by tst-bz34144. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <stdlib.h> + +void +test_float_args (double a, double b, double c, double d, + double e, double f, double g, double h) +{ + if (a != 2.0 || b != 3.0 || c != 4.0 || d != 5.0 + || e != 6.0 || f != 7.0 || g != 8.0 || h != 9.0) + abort (); +} diff --git a/sysdeps/arm/tst-bz34144.c b/sysdeps/arm/tst-bz34144.c new file mode 100644 index 0000000000..61e41b3945 --- /dev/null +++ b/sysdeps/arm/tst-bz34144.c @@ -0,0 +1,32 @@ +/* Test that lazy PLT resolution preserves caller-saved VFP registers + used to pass double arguments (BZ 34144). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <support/test-driver.h> + +extern void test_float_args (double a, double b, double c, double d, + double e, double f, double g, double h); + +static int +do_test (void) +{ + test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0); + return 0; +} + +#include <support/test-driver.c> -- 2.54.0 ++++++ fma-shift-ub.patch ++++++ >From a47b5b2b3eee486c4bea0df65af775296a13f09d Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella <[email protected]> Date: Wed, 27 May 2026 16:48:19 -0300 Subject: [PATCH] math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183) When d (the exponent difference between z and x*y) is exactly 64, the alignment path shifts z left by 64 bits via (zhi = nz.m, zlo = 0) and decrements d to 0, then takes the inner 'if (d < 64)' branch which evaluates 'rhi << (64 - d)' with d == 0. A shift by 64 of a 64-bit value is UB in C. Add the explicit 'if (d == 0)' empty branch (present in the original musl implementation). Checked on x86_64-linux-gnu with --disable-multi-arch and arm-linux-gnueabihf. Reviewed-by: H.J. Lu <[email protected]> (cherry picked from commit 1e7935ae87550323021876f3099bb04aeadd8491) --- math/auto-libm-test-in | 2 ++ math/auto-libm-test-out-fma | 25 +++++++++++++++++++++++++ sysdeps/ieee754/dbl-64/s_fma.c | 5 ++++- 3 files changed, 31 insertions(+), 1 deletion(-) diff --git a/math/auto-libm-test-in b/math/auto-libm-test-in index 2001baa605..82f0aface8 100644 --- a/math/auto-libm-test-in +++ b/math/auto-libm-test-in @@ -6483,6 +6483,8 @@ fma 0x1.000002p-126 -0x1.000002p-26 0x1p103 fma 0x1.000002p-126 0x1.000002p-26 -0x1p103 fma 0x1.000002p-126 -0x1.000002p-26 -0x1p103 +fma 0x1.000008p+0 0x1.000008p+0 0x1p+11 + fma 0x1.7fp+13 0x1.0000000000001p+0 0x1.ffep-48 fma 0x1.fffp+0 0x1.0000000000001p+0 -0x1.fffp+0 fma 0x1.0000002p+0 0x1.ffffffcp-1 0x1p-300 diff --git a/math/auto-libm-test-out-fma b/math/auto-libm-test-out-fma index 438fcb61da..ba1fdc7472 100644 --- a/math/auto-libm-test-out-fma +++ b/math/auto-libm-test-out-fma @@ -13364,6 +13364,31 @@ fma 0x1.000002p-126 -0x1.000002p-26 -0x1p103 = fma tonearest ibm128 0x4.000008p-128 -0x4.000008p-28 -0x8p+100 : -0x8p+100 : inexact = fma towardzero ibm128 0x4.000008p-128 -0x4.000008p-28 -0x8p+100 : -0x8p+100 : inexact = fma upward ibm128 0x4.000008p-128 -0x4.000008p-28 -0x8p+100 : -0x8p+100 : inexact +fma 0x1.000008p+0 0x1.000008p+0 0x1p+11 += fma downward binary32 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.01p+8 : inexact += fma tonearest binary32 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.01p+8 : inexact += fma towardzero binary32 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.01p+8 : inexact += fma upward binary32 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.01001p+8 : inexact += fma downward binary64 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001p+8 : inexact += fma tonearest binary64 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001p+8 : inexact += fma towardzero binary64 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001p+8 : inexact += fma upward binary64 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000008p+8 : inexact += fma downward intel96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma tonearest intel96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma towardzero intel96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma upward intel96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma downward m68k96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma tonearest m68k96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma towardzero m68k96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma upward m68k96 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma downward binary128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma tonearest binary128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma towardzero binary128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma upward binary128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma downward ibm128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma tonearest ibm128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma towardzero ibm128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : += fma upward ibm128 0x1.000008p+0 0x1.000008p+0 0x8p+8 : 0x8.0100001000004p+8 : fma 0x1.7fp+13 0x1.0000000000001p+0 0x1.ffep-48 = fma downward binary64 0x2.fep+12 0x1.0000000000001p+0 0x1.ffep-48 : 0x2.fe00000000002p+12 : inexact = fma tonearest binary64 0x2.fep+12 0x1.0000000000001p+0 0x1.ffep-48 : 0x2.fe00000000002p+12 : inexact diff --git a/sysdeps/ieee754/dbl-64/s_fma.c b/sysdeps/ieee754/dbl-64/s_fma.c index d65d505915..b9147ae32c 100644 --- a/sysdeps/ieee754/dbl-64/s_fma.c +++ b/sysdeps/ieee754/dbl-64/s_fma.c @@ -114,7 +114,10 @@ __fma (double x, double y, double z) zhi = nz.m; e = nz.e - 64; d -= 64; - if (d < 64) + if (d == 0) + /* No further shift of r needed; rhi/rlo are unchanged. */ + ; + else if (d < 64) { rlo = rhi << (64 - d) | rlo >> d | !!(rlo << (64 - d)); rhi = rhi >> d; -- 2.54.0 ++++++ iconv-translit-intermediate-errors.patch ++++++ >From fe0ccc9564c3476f7171cb005884560da0699773 Mon Sep 17 00:00:00 2001 From: Florian Weimer <[email protected]> Date: Tue, 9 Jun 2026 07:28:02 +0200 Subject: [PATCH] iconv: Suppress intermediate errors with //TRANSLIT (bug 34236) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When tentatively converting characters on behalf of __gconv_transliterate, do not create a persistent error. Just produce a local error, and rely on __gconv_transliterate to produce the error if all transliteration options are exhausted. This fixes transliteration of “½” to ASCII, which cannot use the “ 1⁄2 ” alternative. Eventually, the “ 1/2 ” alternative is chosen, but the error sticks. Therefore, iconv exited with status 1 before this change. Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales. This requires changing the way the ICONV template is defined, so that run_program_env is evaluated multiple times. Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not report error exit with transliteration [BZ #32448]"), commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236. Reviewed-by: Aurelien Jarno <[email protected]> (cherry picked from commit e9325bd7d04aacc45cf39505e279b1ca9de22c08) --- iconv/Makefile | 3 ++- iconv/loop.c | 6 ++++-- iconv/tst-iconv_prog.sh | 30 ++++++++++++++++++++---------- 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/iconv/Makefile b/iconv/Makefile index 51ffab9efc..69555cbe57 100644 --- a/iconv/Makefile +++ b/iconv/Makefile @@ -139,7 +139,8 @@ $(objpfx)test-iconvconfig.out: $(objpfx)iconvconfig rm -f $$tmp) > $@; \ $(evaluate-test) -$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog +$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog \ + $(gen-locales) $(BASH) $< $(common-objdir) '$(test-wrapper-env)' \ '$(run-program-env)' '$(rpath-link)' > $@; \ $(evaluate-test) diff --git a/iconv/loop.c b/iconv/loop.c index 27dea1f5d6..81841d0d2d 100644 --- a/iconv/loop.c +++ b/iconv/loop.c @@ -144,8 +144,10 @@ if (irreversible == NULL) \ { \ /* This means we are in call from __gconv_transliterate. In this \ - case we are not doing any error recovery ourselves. */ \ - result = __gconv_mark_illegal_input (step_data); \ + case we are not doing any error recovery ourselves. Do not create \ + a persistent error state. If __gconv_transliterate exhausts all \ + alternatives, it will call __gconv_mark_illegal_input itself. */ \ + result = __GCONV_ILLEGAL_INPUT; \ break; \ } \ \ diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh index f6c7c265a8..ab6e14c685 100644 --- a/iconv/tst-iconv_prog.sh +++ b/iconv/tst-iconv_prog.sh @@ -29,10 +29,10 @@ LIBPATH=$codir:$codir/iconvdata # How the start the iconv(1) program. $from is not defined/expanded yet. ICONV=' +$test_wrapper_env $run_program_env $codir/elf/ld.so --library-path $library_path:$LIBPATH --inhibit-rpath ${from}.so $codir/iconv/iconv_prog ' -ICONV="$test_wrapper_env $run_program_env $ICONV" TIMEOUTFACTOR=${TIMEOUTFACTOR:-1} @@ -220,6 +220,7 @@ testarray=( "\x00\x00;;INVALID;UTF-8;1" "\x00\x00;;UTF-8;INVALID;1" "\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0" +"X\xc2\xbdY;;UTF-8;ASCII//TRANSLIT;0" ) # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret @@ -280,12 +281,21 @@ check_errtest_result () fi } -for testcommand in "${testarray[@]}"; do - twobyte="$(echo "$testcommand" | cut -d";" -f 1)" - c="$(echo "$testcommand" | cut -d";" -f 2)" - from="$(echo "$testcommand" | cut -d";" -f 3)" - to="$(echo "$testcommand" | cut -d";" -f 4)" - eret="$(echo "$testcommand" | cut -d";" -f 5)" - execute_test - check_errtest_result -done +run_test_array () +{ + for testcommand in "${testarray[@]}"; do + twobyte="$(echo "$testcommand" | cut -d";" -f 1)" + c="$(echo "$testcommand" | cut -d";" -f 2)" + from="$(echo "$testcommand" | cut -d";" -f 3)" + to="$(echo "$testcommand" | cut -d";" -f 4)" + eret="$(echo "$testcommand" | cut -d";" -f 5)" + execute_test + check_errtest_result + done +} + +echo "info: testing C locale" +run_test_array +echo "info: testing en_US.UTF-8 locale" +run_program_env="$run_program_env LC_ALL=en_US.UTF-8" +run_test_array -- 2.54.0 ++++++ resolv-sprintrrf-buffer-overreads.patch ++++++ >From b53314e8060d5f9baaf95dee9509079bdece7b32 Mon Sep 17 00:00:00 2001 From: Florian Weimer <[email protected]> Date: Fri, 19 Jun 2026 18:22:20 +0200 Subject: [PATCH] resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell <[email protected]> Reviewed-by: Adhemerval Zanella <[email protected]> --- resolv/ns_print.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/resolv/ns_print.c b/resolv/ns_print.c index 8c876b147e..6832255a25 100644 --- a/resolv/ns_print.c +++ b/resolv/ns_print.c @@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, case ns_t_loc: { char t[255]; - /* XXX protocol format checking? */ + if (rdlen != 16) + goto formerr; (void) loc_ntoa(rdata, t); T(addstr(t, strlen(t), &buf, &buflen)); break; @@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen, /* address suffix: provided only when prefix len != 128 */ if (pbit < 128) { - if (rdata + pbyte >= edata) goto formerr; + unsigned int bytelen = sizeof(a) - pbyte; + if (edata - rdata < bytelen) goto formerr; memset(&a, 0, sizeof(a)); - memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); + memcpy(&a.s6_addr[pbyte], rdata, bytelen); if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) return -1; addlen(strlen(buf), &buf, &buflen); - rdata += sizeof(a) - pbyte; + rdata += bytelen; } /* prefix name: provided only when prefix len > 0 */ -- 2.54.0 ++++++ resolv-sprintrrf-inet-ntop-check.patch ++++++ >From 5214bb0b1c50d5a367caef4bea2cfaa6fe14490b Mon Sep 17 00:00:00 2001 From: Florian Weimer <[email protected]> Date: Fri, 19 Jun 2026 18:22:20 +0200 Subject: [PATCH] resolv: Check for inet_ntop failure in ns_sprintrrf This makes the output more consistent (either failure or complete output) and helps with systematic testing with varying buffer sizes. Reviewed-by: Carlos O'Donell <[email protected]> Reviewed-by: Adhemerval Zanella <[email protected]> --- resolv/ns_print.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/resolv/ns_print.c b/resolv/ns_print.c index 882a86e58e..8c876b147e 100644 --- a/resolv/ns_print.c +++ b/resolv/ns_print.c @@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen, switch (type) { case ns_t_a: if (rdlen != (size_t)NS_INADDRSZ) - goto formerr; - (void) inet_ntop(AF_INET, rdata, buf, buflen); + goto formerr; + if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) + return -1; addlen(strlen(buf), &buf, &buflen); break; @@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen, } case ns_t_aaaa: - if (rdlen != (size_t)NS_IN6ADDRSZ) - goto formerr; - (void) inet_ntop(AF_INET6, rdata, buf, buflen); + if (rdlen != (size_t)NS_IN6ADDRSZ) + goto formerr; + if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL) + return -1; addlen(strlen(buf), &buf, &buflen); break; @@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, goto formerr; /* Address. */ - (void) inet_ntop(AF_INET, rdata, buf, buflen); + if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) + return -1; addlen(strlen(buf), &buf, &buflen); rdata += NS_INADDRSZ; @@ -452,7 +455,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, if (rdata + pbyte >= edata) goto formerr; memset(&a, 0, sizeof(a)); memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); - (void) inet_ntop(AF_INET6, &a, buf, buflen); + if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) + return -1; addlen(strlen(buf), &buf, &buflen); rdata += sizeof(a) - pbyte; } -- 2.54.0 ++++++ resolv-sprintrrf-unkown-types.patch ++++++ >From 1876ea34bbb723fcec4345a08ae19346630bff89 Mon Sep 17 00:00:00 2001 From: Florian Weimer <[email protected]> Date: Fri, 19 Jun 2026 18:22:20 +0200 Subject: [PATCH] resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <[email protected]> Reviewed-by: Adhemerval Zanella <[email protected]> --- resolv/ns_print.c | 96 ----------------------------------------------- 1 file changed, 96 deletions(-) diff --git a/resolv/ns_print.c b/resolv/ns_print.c index cef2212fd2..882a86e58e 100644 --- a/resolv/ns_print.c +++ b/resolv/ns_print.c @@ -434,96 +434,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, break; } - case ns_t_cert: { - u_int c_type, key_tag, alg; - int n; - unsigned int siz; - char base64_cert[8192], tmp[40]; - const char *leader; - - c_type = ns_get16(rdata); rdata += NS_INT16SZ; - key_tag = ns_get16(rdata); rdata += NS_INT16SZ; - alg = (u_int) *rdata++; - - len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg)); - T(addstr(tmp, len, &buf, &buflen)); - siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */ - if (siz > sizeof(base64_cert) * 3/4) { - const char *str = "record too long to print"; - T(addstr(str, strlen(str), &buf, &buflen)); - } - else { - len = b64_ntop(rdata, edata-rdata, base64_cert, siz); - - if (len < 0) - goto formerr; - else if (len > 15) { - T(addstr(" (", 2, &buf, &buflen)); - leader = "\n\t\t"; - spaced = 0; - } - else - leader = " "; - - for (n = 0; n < len; n += 48) { - T(addstr(leader, strlen(leader), - &buf, &buflen)); - T(addstr(base64_cert + n, MIN(len - n, 48), - &buf, &buflen)); - } - if (len > 15) - T(addstr(" )", 2, &buf, &buflen)); - } - break; - } - - case ns_t_tkey: { - /* KJD - need to complete this */ - u_long t; - int mode, err, keysize; - - /* Algorithm name. */ - T(addname(msg, msglen, &rdata, origin, &buf, &buflen)); - T(addstr(" ", 1, &buf, &buflen)); - - /* Inception. */ - t = ns_get32(rdata); rdata += NS_INT32SZ; - len = SPRINTF((tmp, "%lu ", t)); - T(addstr(tmp, len, &buf, &buflen)); - - /* Expiration. */ - t = ns_get32(rdata); rdata += NS_INT32SZ; - len = SPRINTF((tmp, "%lu ", t)); - T(addstr(tmp, len, &buf, &buflen)); - - /* Mode , Error, Key Size. */ - /* Priority, Weight, Port. */ - mode = ns_get16(rdata); rdata += NS_INT16SZ; - err = ns_get16(rdata); rdata += NS_INT16SZ; - keysize = ns_get16(rdata); rdata += NS_INT16SZ; - len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize)); - T(addstr(tmp, len, &buf, &buflen)); - - /* XXX need to dump key, print otherdata length & other data */ - break; - } - - case ns_t_tsig: { - /* BEW - need to complete this */ - int n; - - T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); - T(addstr(" ", 1, &buf, &buflen)); - rdata += 8; /*%< time */ - n = ns_get16(rdata); rdata += INT16SZ; - rdata += n; /*%< sig */ - n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ - sprintf(buf, "%d", ns_get16(rdata)); - rdata += INT16SZ; - addlen(strlen(buf), &buf, &buflen); - break; - } - case ns_t_a6: { struct in6_addr a; int pbyte, pbit; @@ -557,12 +467,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, break; } - case ns_t_opt: { - len = SPRINTF((tmp, "%u bytes", class)); - T(addstr(tmp, len, &buf, &buflen)); - break; - } - default: snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type); comment = errbuf; -- 2.54.0 ++++++ struct-reserved-members.patch ++++++ >From 18b97b03b7442d8ba0860e43145f8724c9e77b17 Mon Sep 17 00:00:00 2001 From: Jakub Jelinek <[email protected]> Date: Tue, 17 Feb 2026 17:06:48 +0100 Subject: [PATCH] Rename __unused fields to __glibc_reserved. __unused is often defined to __attribute__((unused)) in BSD sources and furthermore libstdc++ testsuite uses it as a macro to verify libstdc++ headers don't use __unused identifiers. In ~2012 glibc headers have been cleaned up, but some new uses of __unused have reappeared (s390 fenv.h already many years ago, the rest last November). Reviewed-by: Florian Weimer <[email protected]> (cherry picked from commit 243bdfec8f7cd4a85a8ce6e4e9a5a5accd3ce1aa) --- sysdeps/powerpc/nptl/bits/struct_mutex.h | 2 +- sysdeps/s390/fpu/bits/fenv.h | 8 ++++---- sysdeps/s390/nptl/bits/struct_mutex.h | 2 +- sysdeps/x86/nptl/bits/struct_mutex.h | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/sysdeps/powerpc/nptl/bits/struct_mutex.h b/sysdeps/powerpc/nptl/bits/struct_mutex.h index 1472af21f7..ebf2d50922 100644 --- a/sysdeps/powerpc/nptl/bits/struct_mutex.h +++ b/sysdeps/powerpc/nptl/bits/struct_mutex.h @@ -32,7 +32,7 @@ struct __pthread_mutex_s int __kind; #if __WORDSIZE == 64 short __spins; - short __unused; + short __glibc_reserved; __pthread_list_t __list; # define __PTHREAD_MUTEX_HAVE_PREV 1 #else diff --git a/sysdeps/s390/fpu/bits/fenv.h b/sysdeps/s390/fpu/bits/fenv.h index b9e844e393..33e88fbe9d 100644 --- a/sysdeps/s390/fpu/bits/fenv.h +++ b/sysdeps/s390/fpu/bits/fenv.h @@ -76,10 +76,10 @@ typedef unsigned int fexcept_t; /* size of fpc */ typedef struct { fexcept_t __fpc; - void *__unused; - /* The field __unused (formerly __ieee_instruction_pointer) is a relict from - commit "Remove PTRACE_PEEKUSER" (87b9b50f0d4b92248905e95a06a13c513dc45e59) - and isn't used anymore. */ + void *__glibc_reserved; + /* The field __glibc_reserved (formerly __ieee_instruction_pointer) is a + relict from commit "Remove PTRACE_PEEKUSER" + (87b9b50f0d4b92248905e95a06a13c513dc45e59) and isn't used anymore. */ } fenv_t; /* If the default argument is used we use this value. */ diff --git a/sysdeps/s390/nptl/bits/struct_mutex.h b/sysdeps/s390/nptl/bits/struct_mutex.h index d069b485d1..571265267c 100644 --- a/sysdeps/s390/nptl/bits/struct_mutex.h +++ b/sysdeps/s390/nptl/bits/struct_mutex.h @@ -32,7 +32,7 @@ struct __pthread_mutex_s int __kind; #if __WORDSIZE == 64 short __spins; - short __unused; + short __glibc_reserved; __pthread_list_t __list; # define __PTHREAD_MUTEX_HAVE_PREV 1 #else diff --git a/sysdeps/x86/nptl/bits/struct_mutex.h b/sysdeps/x86/nptl/bits/struct_mutex.h index 9c19dff660..13c9894ad4 100644 --- a/sysdeps/x86/nptl/bits/struct_mutex.h +++ b/sysdeps/x86/nptl/bits/struct_mutex.h @@ -32,7 +32,7 @@ struct __pthread_mutex_s int __kind; #ifdef __x86_64__ short __spins; - short __unused; + short __glibc_reserved; __pthread_list_t __list; # define __PTHREAD_MUTEX_HAVE_PREV 1 #else -- 2.54.0
