Last commit made on 2019-11-22
Get this branch:
git clone -b release/2.23/master

Branch merges

Branch information


Recent commits

b039fd8... by Marcin Kościelnicki <> on 2019-11-20

rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126) [BZ #25204]

The problem was introduced in glibc 2.23, in commit
("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT").

(cherry picked from commit d5dfad4326fc683c813df1e37bbf5cf920591c8e)

8337b12... by "H.J. Lu" <email address hidden> on 2018-01-19

x86-64: Properly align La_x86_64_retval to VEC_SIZE [BZ #22715]

_dl_runtime_profile calls _dl_call_pltexit, passing a pointer to
La_x86_64_retval which is allocated on stack. The lrv_vector0
field in La_x86_64_retval must be aligned to size of vector register.
When allocating stack space for La_x86_64_retval, we need to make sure
that the address of La_x86_64_retval + RV_VECTOR0_OFFSET is aligned to
VEC_SIZE. This patch checks the alignment of the lrv_vector0 field
and pads the stack space if needed.

Tested with x32 and x86-64 on SSE4, AVX and AVX512 machines. It fixed

FAIL: elf/tst-audit10
FAIL: elf/tst-audit4
FAIL: elf/tst-audit5
FAIL: elf/tst-audit6
FAIL: elf/tst-audit7

on x32 AVX512 machine.

(cherry picked from commit 207a72e2988c6d6343f50fe0128eb4fc4edfdd15)

 [BZ #22715]
 * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_profile): Properly
 align La_x86_64_retval to VEC_SIZE.

fbd72f1... by Florian Weimer on 2018-01-11

x86: Fix mis-merge of XSAVE trampoline selection [BZ #22641]

The change is best viewed with “diff -w”:

@@ -226,6 +226,7 @@ init_cpu_features (struct cpu_features *cpu_features)
    /* Determine if FMA4 is usable. */
      cpu_features->feature[index_FMA4_Usable] |= bit_FMA4_Usable;
+ }

       /* For _dl_runtime_resolve, set xsave_state_size to xsave area
   size + integer register save size and align it to 64 bytes. */
@@ -292,7 +293,6 @@ init_cpu_features (struct cpu_features *cpu_features)
- }


Without this change, XSAVE support will never be selected unless the CPU
also supports AVX, which is not what we want. For example, if AVX is
disabled, but MPX is supported, the BND registers are not preserved if
we use FXSAVE instead of XSAVE.

This fixes commit 26d289bb92b6d1125536644f607c73617463477d (x86-64:
Use fxsave/xsave/xsavec in _dl_runtime_resolve).

26d289b... by "H.J. Lu" <email address hidden> on 2017-10-22

x86-64: Use fxsave/xsave/xsavec in _dl_runtime_resolve [BZ #21265]

In _dl_runtime_resolve, use fxsave/xsave/xsavec to preserve all vector,
mask and bound registers. It simplifies _dl_runtime_resolve and supports
different calling conventions. code size is reduced by more than
1 KB. However, use fxsave/xsave/xsavec takes a little bit more cycles
than saving and restoring vector and bound registers individually.

Latency for _dl_runtime_resolve to lookup the function, foo, from one
shared library plus

                             Before After Change

Westmere (SSE)/fxsave 345 866 151%
IvyBridge (AVX)/xsave 420 643 53%
Haswell (AVX)/xsave 713 1252 75%
Skylake (AVX+MPX)/xsavec 559 719 28%
Skylake (AVX512+MPX)/xsavec 145 272 87%
Ryzen (AVX)/xsavec 280 553 97%

This is the worst case where portion of time spent for saving and
restoring registers is bigger than majority of cases. With smaller
_dl_runtime_resolve code size, overall performance impact is negligible.

On IvyBridge, differences in build and test time of binutils with lazy
binding GCC and binutils are noises. On Westmere, differences in
bootstrap and "makc check" time of GCC 7 with lazy binding GCC and
binutils are also noises.

 [BZ #21265]
 * sysdeps/x86/cpu-features-offsets.sym (XSAVE_STATE_SIZE_OFFSET):
 * sysdeps/x86/cpu-features.c: Include <libc-internal.h>.
 (init_cpu_features): Set xsave_state_size and bit_XSAVEC_Usable
 if needed.
 * sysdeps/x86/cpu-features.h (bit_XSAVEC_Usable): New.
 (STATE_SAVE_MASK): Likewise.
 [__ASSEMBLER__]: Include <cpu-features-offsets.h>.
 (cpu_features): Add xsave_state_size.
 (index_XSAVEC_Usable): New.
 * sysdeps/x86_64/dl-machine.h (elf_machine_runtime_setup):
 Replace _dl_runtime_resolve_sse, _dl_runtime_resolve_avx and
 _dl_runtime_resolve_avx512 with _dl_runtime_resolve_fxsave,
 _dl_runtime_resolve_xsave and _dl_runtime_resolve_xsavec.
 * sysdeps/x86_64/dl-trampoline.S: Include <cpu-features.h>.
 instead of VEC_SIZE.
 (REGISTER_SAVE_BND1): Likewise.
 (REGISTER_SAVE_BND3): Likewise.
 (REGISTER_SAVE_RAX): Always defined to 0.
 (VMOV): Removed.
 (_dl_runtime_resolve_avx512): Likewise.
 (_dl_runtime_resolve_avx): Likewise.
 (_dl_runtime_resolve_sse): Likewise.
 (_dl_runtime_resolve_fxsave): Likewise.
 (USE_XSAVE): Likewise.
 (_dl_runtime_resolve_xsave): Likewise.
 (USE_XSAVEC): Likewise.
 (_dl_runtime_resolve_xsavec): Likewise.
 * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_resolve_avx512):
 (_dl_runtime_resolve_avx): Likewise.
 (_dl_runtime_resolve_sse): Likewise.
 (_dl_runtime_resolve_fxsave): New.
 (_dl_runtime_resolve_xsave): Likewise.
 (_dl_runtime_resolve_xsavec): Likewise.
 (_dl_runtime_profile): Defined only if _dl_runtime_profile is

(cherry picked from commit b52b0d793dcb226ecb0ecca1e672ca265973233c)

9d521f5... by "H.J. Lu" <email address hidden> on 2017-10-21

Update NEWS for [BZ #21666] fix

93710f5... by "H.J. Lu" <email address hidden> on 2017-10-19

x86-64: Verify that _dl_runtime_resolve preserves vector registers

On x86-64, _dl_runtime_resolve must preserve the first 8 vector
registers. Add 3 _dl_runtime_resolve tests to verify that SSE,
AVX and AVX512 registers are preserved.

 * sysdeps/x86_64/Makefile (tests): Add tst-sse, tst-avx and
 (test-extras): Add tst-avx-aux and tst-avx512-aux.
 (extra-test-objs): Add tst-avx-aux.o and tst-avx512-aux.o.
 (modules-names): Add tst-ssemod, tst-avxmod and tst-avx512mod.
 ($(objpfx)tst-sse): New rule.
 ($(objpfx)tst-avx): Likewise.
 ($(objpfx)tst-avx512): Likewise.
 (CFLAGS-tst-avx-aux.c): New.
 (CFLAGS-tst-avxmod.c): Likewise.
 (CFLAGS-tst-avx512-aux.c): Likewise.
 (CFLAGS-tst-avx512mod.c): Likewise.
 * sysdeps/x86_64/tst-avx-aux.c: New file.
 * sysdeps/x86_64/tst-avx.c: Likewise.
 * sysdeps/x86_64/tst-avx512-aux.c: Likewise.
 * sysdeps/x86_64/tst-avx512.c: Likewise.
 * sysdeps/x86_64/tst-avx512mod.c: Likewise.
 * sysdeps/x86_64/tst-avxmod.c: Likewise.
 * sysdeps/x86_64/tst-sse.c: Likewise.
 * sysdeps/x86_64/tst-ssemod.c: Likewise.

(cherry picked from commit 3403a17fea8ccef7dc5f99553a13231acf838744)

bc56638... by "H.J. Lu" <email address hidden> on 2017-10-19

Avoid .symver on common symbols [BZ #21666]

The .symver directive on common symbol just creates a new common symbol,
not an alias and the newer assembler with the bug fix for

will issue an error. Before the fix, we got

$ readelf -sW | grep "loc[12s]"
  5109: 00000000003a0608 8 OBJECT LOCAL DEFAULT 36 loc1
  5188: 00000000003a0610 8 OBJECT LOCAL DEFAULT 36 loc2
  5455: 00000000003a0618 8 OBJECT LOCAL DEFAULT 36 locs
  6575: 00000000003a05f0 8 OBJECT GLOBAL DEFAULT 36 locs@GLIBC_2.2.5
  7156: 00000000003a05f8 8 OBJECT GLOBAL DEFAULT 36 loc1@GLIBC_2.2.5
  7312: 00000000003a0600 8 OBJECT GLOBAL DEFAULT 36 loc2@GLIBC_2.2.5

in The versioned loc1, loc2 and locs have the wrong addresses.
After the fix, we got

$ readelf -sW | grep "loc[12s]"
  6570: 000000000039e3b8 8 OBJECT GLOBAL DEFAULT 34 locs@GLIBC_2.2.5
  7151: 000000000039e3c8 8 OBJECT GLOBAL DEFAULT 34 loc1@GLIBC_2.2.5
  7307: 000000000039e3c0 8 OBJECT GLOBAL DEFAULT 34 loc2@GLIBC_2.2.5

 [BZ #21666]
 * misc/regexp.c (loc1): Add __attribute__ ((nocommon));
 (loc2): Likewise.
 (locs): Likewise.

(cherry picked from commit 388b4f1a02f3a801965028bbfcd48d905638b797)

4401ec2... by "H.J. Lu" <email address hidden> on 2017-10-19

X86-64: Correct CFA in _dl_runtime_resolve

When stack is re-aligned in _dl_runtime_resolve, there is no need to
adjust CFA when allocating register save area on stack.

 * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_resolve): Don't
 adjust CFA when allocating register save area on re-aligned

(cherry picked from commit 0ac8ee53e8efbfd6e1c37094b4653f5c2dad65b5)

d990d79... by Florian Weimer on 2017-06-14

i686: Add missing IS_IN (libc) guards to vectorized strcspn

Since commit d957c4d3fa48d685ff2726c605c988127ef99395 (i386: Compile
rtld-*.os with -mno-sse -mno-mmx -mfpmath=387), vector intrinsics can
no longer be used in, even if the compiled code never makes it
into the final link. This commit adds the missing IS_IN (libc)
guard to the SSE 4.2 strcspn implementation, so that it can be used from in the future.

(cherry picked from commit 69052a3a95da37169a08f9e59b2cc1808312753c)

901d3d5... by Siddhesh Poyarekar <email address hidden> on 2017-03-07

Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209)

The LD_HWCAP_MASK environment variable may alter the selection of
function variants for some architectures. For AT_SECURE process it
means that if an outdated routine has a bug that would otherwise not
affect newer platforms by default, LD_HWCAP_MASK will allow that bug
to be exploited.

To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid

 [BZ #21209]
 * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
 AT_SECURE processes.
 * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.

(cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd)