Bug 15946 (CVE-2013-7423) - getaddrinfo() writes DNS queries to random file descriptors under high load (CVE-2013-7423)
Summary: getaddrinfo() writes DNS queries to random file descriptors under high load (...
Status: RESOLVED FIXED
Alias: CVE-2013-7423
Product: glibc
Classification: Unclassified
Component: network (show other bugs)
Version: unspecified
: P2 critical
Target Milestone: 2.20
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-12 09:50 UTC by arnaud.lb
Modified: 2016-04-22 20:00 UTC (History)
9 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security+


Attachments
reproducing code (1.22 KB, text/x-csrc)
2013-09-12 09:50 UTC, arnaud.lb
Details
Corrected reproducing code (1.22 KB, text/plain)
2015-03-03 11:26 UTC, Andreas Schwab
Details

Note You need to log in before you can comment on or make changes to this bug.
Description arnaud.lb 2013-09-12 09:50:17 UTC
Created attachment 7193 [details]
reproducing code

Under high load, getaddrinfo() starts sending DNS queries to random
file descriptors, e.g. some unrelated socket connected to a remote service.

The attached code reproduces the bug on at least the following configurations:

Archlinux libc6 2.18
Debian libc6 2.6.11
Debian libc6 2.13-38
Debian libc6 2.17-92
Ubuntu libc6 2.17-0ubuntu5

What the code does is to fill the file descriptor space, closing and creating many file descriptors, to maximize the chances of reproducing the bug:

 - a thread listens to a local unix socket
 - a thread connects to the unix socket, never writes to it, dups the
connection as much as possible (fills the fd space), closes the dups, and starts
dup()ing again
 - lots of threads call getaddrinfo()

Under less than a minute, the listener starts reading garbage.

The garbage received by the listener seems to always be a full, well-formed, DNS query. It seems to always be an AAAA query, even when hints.ai_family is AF_INET. All queries are similar, only the id changes.
Comment 1 Ian Lance Taylor 2013-09-15 16:05:08 UTC
Let me add that this is a serious problem for some programs written in Go, as in Go it's easy and natural to make highly concurrent calls to the name lookup routines.  For the bug from the Go perspective see http://golang.org/issue/6336 .
Comment 2 Rich Felker 2014-03-06 20:27:08 UTC
Ping. This looks extremely serious and does not seem to have received any attention so far. The Go issue thread suggests that it's likely related to some kind of socket caching going on in glibc's resolver; if so, this caching should just be disabled completely (replaced with new locally-opened socket per query) unless it can easily be fixed.
Comment 3 Andreas Schwab 2014-03-06 21:01:16 UTC
The reson might be that although it is easy to reproduce it is hard to track down.  Perhaps you can give it a try?
Comment 4 Rich Felker 2014-03-06 21:07:53 UTC
I can look, but I'm not at all familiar with the code. The point of my last comment however was that when a feature has a bug that's this critical, a big hammer (disabling/removing the caching or whatever) is generally the right solution unless/until someone is familiar enough to fix the problem on a more detailed level. It's a shame that there's been a release with such a critical bug (and anything that corrupts random open files is critical) left unfixed and even unacknowledged.
Comment 5 Andreas Schwab 2014-03-06 21:16:43 UTC
(In reply to Rich Felker from comment #4)
> I can look, but I'm not at all familiar with the code.

Probably nobody is, since it was originally lifted from the BIND sources.
Comment 6 cvs-commit@gcc.gnu.org 2014-06-03 16:05:03 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  f9d2d03254a58d92635a311a42253eeed5a40a47 (commit)
      from  71840409ea45ab9e49d0ac70dfc1c355accf355f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f9d2d03254a58d92635a311a42253eeed5a40a47

commit f9d2d03254a58d92635a311a42253eeed5a40a47
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog         |    6 ++++++
 NEWS              |   20 ++++++++++----------
 resolv/res_send.c |    1 +
 3 files changed, 17 insertions(+), 10 deletions(-)
Comment 7 Andreas Schwab 2014-06-03 16:05:49 UTC
Fixed in 2.20.
Comment 8 cvs-commit@gcc.gnu.org 2014-06-22 07:46:16 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, allan/2.19/backport has been created
        at  7e09ce56759640a4bf10e4d6ddca77757e115f13 (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7e09ce56759640a4bf10e4d6ddca77757e115f13

commit 7e09ce56759640a4bf10e4d6ddca77757e115f13
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Mon May 26 11:40:08 2014 +0530

    Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (BZ #16878)
    
    The netgroups nss modules in the glibc tree use NSS_STATUS_UNAVAIL
    (with errno as ERANGE) when the supplied buffer does not have
    sufficient space for the result.  This is wrong, because the canonical
    way to indicate insufficient buffer is to set the errno to ERANGE and
    the status to NSS_STATUS_TRYAGAIN, as is used by all other modules.
    
    This fixes nscd behaviour when the nss_ldap module returns
    NSS_STATUS_TRYAGAIN to indicate that a netgroup entry is too long to
    fit into the supplied buffer.
    
    (cherry picked from commit c3ec475c5dd16499aa040908e11d382c3ded9692)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6489b92b735504bbb124c0a29967e52906101e56

commit 6489b92b735504bbb124c0a29967e52906101e56
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed Mar 12 17:27:22 2014 +0530

    Provide correct buffer length to netgroup queries in nscd (BZ #16695)
    
    The buffer to query netgroup entries is allocated sufficient space for
    the netgroup entries and the key to be appended at the end, but it
    sends in an incorrect available length to the NSS netgroup query
    functions, resulting in overflow of the buffer in some special cases.
    The fix here is to factor in the key length when sending the available
    buffer and buffer length to the query functions.
    
    (cherry picked from commit c44496df2f090a56d3bf75df930592dac6bba46f)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=00e1e5950611a1d8d5d6605906d11432ecd6e7c5

commit 00e1e5950611a1d8d5d6605906d11432ecd6e7c5
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 20 21:52:53 2014 +0100

    [BZ #16046] dl_iterate_phdr static executable test
    
    (cherry picked from commit 257ce7127e2f64a6a959b146786cd43de0e42b5f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0625ebcc25a4eda851b53b50f99fa49f790b9ee8

commit 0625ebcc25a4eda851b53b50f99fa49f790b9ee8
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 20 12:41:27 2014 +0200

    Fix another memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit aa6ec754f3b4b1df81d186480c534b6486a1e6ee)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fc93c8a02c25e2486f3057ae06cf79209c381832

commit fc93c8a02c25e2486f3057ae06cf79209c381832
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu Jun 19 15:38:03 2014 +0200

    Fix memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit 4d43ef1e7434d7d419afbcd754931cb0c794763c)
    
    Conflicts:
    	posix/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7b17d60f13089585c2b63d46cbc660c4b85d169d

commit 7b17d60f13089585c2b63d46cbc660c4b85d169d
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    (cherry picked from commit f9d2d03254a58d92635a311a42253eeed5a40a47)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=76aebfbb87ecc33e59d29a8adda76dfcdbc9213d

commit 76aebfbb87ecc33e59d29a8adda76dfcdbc9213d
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Feb 18 10:57:25 2014 +0100

    Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    Instead of trying to guess whether the second buffer needs to be freed
    set a flag at the place it is allocated
    
    (cherry picked from commit ab09bf616ad527b249aca5f2a4956fd526f0712f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c6ce0dadcfd14973ba880f4e043058a9367f00ce

commit c6ce0dadcfd14973ba880f4e043058a9367f00ce
Author: Ondřej Bílka <neleai@seznam.cz>
Date:   Sun Feb 16 12:59:23 2014 +0100

    Deduplicate resolv/nss_dns/dns-host.c
    
    In resolv/nss_dns/dns-host.c one of code path duplicated code after
    that. We merge these paths.
    
    (cherry picked from commit ab7ac0f2cf8731fe4c3f3aea6088a7c0127b5725)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73

commit 4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu Feb 13 11:01:57 2014 +0100

    Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    (cherry picked from commit d668061994a7486a3ba9c7d5e7882d85a2883707)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=00a84253c5bc7dffb7a0a666cea21ea5e0288771

commit 00a84253c5bc7dffb7a0a666cea21ea5e0288771
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu May 8 16:53:01 2014 +0200

    Fix unbound stack use in NIS NSS module
    
    (cherry picked from commit 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=30026b69015db3f82407df83dc1118518ee1fa5c

commit 30026b69015db3f82407df83dc1118518ee1fa5c
Author: Allan McRae <allan@archlinux.org>
Date:   Sat Jun 21 17:23:55 2014 +1000

    Mention CVE-2014-4043 in NEWS
    
    (cherry picked from commit d03efb2f979defd473955a455d66b949961d26b2)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa

commit e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Jun 11 23:12:52 2014 +0200

    posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
    
    POSIX requires that we make a copy, so we allocate a new string
    and free it in posix_spawn_file_actions_destroy.
    
    Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz.  This bug
    may have security implications.
    
    (cherry picked from commit 89e435f3559c53084498e9baad22172b64429362)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------
Comment 9 cvs-commit@gcc.gnu.org 2014-08-28 10:26:08 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, allan/2.19/backport has been created
        at  e3050a640f18eec4bc4e3f7b7f22c5b99c47028b (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e3050a640f18eec4bc4e3f7b7f22c5b99c47028b

commit e3050a640f18eec4bc4e3f7b7f22c5b99c47028b
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 26 19:38:59 2014 +0200

    __gconv_translit_find: Disable function [BZ #17187]
    
    This functionality has never worked correctly, and the implementation
    contained a security vulnerability (CVE-2014-5119).
    
    (cherry picked from commit a1a6a401ab0a3c9f15fb7eaebbdcee24192254e8)
    (cherry picked from commit f9df71e895d3552d557e783fdb9d133328195645)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=394efd467f466be377be1066bb07d331390a5658

commit 394efd467f466be377be1066bb07d331390a5658
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Fri Aug 1 09:48:17 2014 +0200

    NEWS: Explain the s390 jmp_buf / ucontext_t ABI change reversal.
    
    (cherry picked from commit 95ee7fb13ba99ba265b49531c57e1cb8db629bc6)
    
    Typo fix as in commit 45ef66289acbab17278a73512f9b2a9d8a7ca79d and
    NEW enty adjusted to reflect revert occuring in 2.19.1 and 2.20.
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3942f5e5f7282161d31a60f84020eec1aa86bb82

commit 3942f5e5f7282161d31a60f84020eec1aa86bb82
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Thu Aug 28 16:53:13 2014 +1000

    S/390: Revert the jmp_buf/ucontext_t ABI change
    
    Backport of commit 2f438e20ab591641760e97458d5d1569942eced5

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a5dd31f514e3ab41bfe60cdeacd75d875006d9cc

commit a5dd31f514e3ab41bfe60cdeacd75d875006d9cc
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:05:03 2014 +0200

    manual: Update the locale documentation
    
    (cherry picked from commit 585367266923156ac6fb789939a923641ba5aaf4)
    
    Conflicts:
    	manual/locale.texi

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d475d58097efe764e2567fca0ea194d5d80150ce

commit d475d58097efe764e2567fca0ea194d5d80150ce
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon May 12 15:24:12 2014 +0200

    _nl_find_locale: Improve handling of crafted locale names [BZ #17137]
    
    Prevent directory traversal in locale-related environment variables
    (CVE-2014-0475).
    
    (cherry picked from commit 4e8f95a0df7c2300b830ec12c0ae1e161bc8a8a3)
    
    Conflicts:
    	NEWS
    	localedata/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1298cdbed6596663785254f63cb92af265aee8e0

commit 1298cdbed6596663785254f63cb92af265aee8e0
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:41:52 2014 +0200

    setlocale: Use the heap for the copy of the locale argument
    
    This avoids alloca calls with potentially large arguments.
    
    (cherry picked from commit d183645616b0533b3acee28f1a95570bffbdf50f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5754d77ab9899688380da1a52b02f62815b3d34b

commit 5754d77ab9899688380da1a52b02f62815b3d34b
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Mon May 26 11:40:08 2014 +0530

    Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (BZ #16878)
    
    The netgroups nss modules in the glibc tree use NSS_STATUS_UNAVAIL
    (with errno as ERANGE) when the supplied buffer does not have
    sufficient space for the result.  This is wrong, because the canonical
    way to indicate insufficient buffer is to set the errno to ERANGE and
    the status to NSS_STATUS_TRYAGAIN, as is used by all other modules.
    
    This fixes nscd behaviour when the nss_ldap module returns
    NSS_STATUS_TRYAGAIN to indicate that a netgroup entry is too long to
    fit into the supplied buffer.
    
    (cherry picked from commit c3ec475c5dd16499aa040908e11d382c3ded9692)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b5a823c6c62a05a793aa2d6ff208d1261b46f281

commit b5a823c6c62a05a793aa2d6ff208d1261b46f281
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed Mar 12 17:27:22 2014 +0530

    Provide correct buffer length to netgroup queries in nscd (BZ #16695)
    
    The buffer to query netgroup entries is allocated sufficient space for
    the netgroup entries and the key to be appended at the end, but it
    sends in an incorrect available length to the NSS netgroup query
    functions, resulting in overflow of the buffer in some special cases.
    The fix here is to factor in the key length when sending the available
    buffer and buffer length to the query functions.
    
    (cherry picked from commit c44496df2f090a56d3bf75df930592dac6bba46f)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9c4b0856b5627d443edc924ae972a27078c53112

commit 9c4b0856b5627d443edc924ae972a27078c53112
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 20 21:52:53 2014 +0100

    [BZ #16046] dl_iterate_phdr static executable test
    
    (cherry picked from commit 257ce7127e2f64a6a959b146786cd43de0e42b5f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5ec38d177c9089db1bc62546bfaf411c0cabeb6d

commit 5ec38d177c9089db1bc62546bfaf411c0cabeb6d
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 20 12:41:27 2014 +0200

    Fix another memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit aa6ec754f3b4b1df81d186480c534b6486a1e6ee)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4498c0516d9f16feeca46820ba8ca2e62f916f82

commit 4498c0516d9f16feeca46820ba8ca2e62f916f82
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu Jun 19 15:38:03 2014 +0200

    Fix memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit 4d43ef1e7434d7d419afbcd754931cb0c794763c)
    
    Conflicts:
    	posix/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7b17d60f13089585c2b63d46cbc660c4b85d169d

commit 7b17d60f13089585c2b63d46cbc660c4b85d169d
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    (cherry picked from commit f9d2d03254a58d92635a311a42253eeed5a40a47)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=76aebfbb87ecc33e59d29a8adda76dfcdbc9213d

commit 76aebfbb87ecc33e59d29a8adda76dfcdbc9213d
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Feb 18 10:57:25 2014 +0100

    Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    Instead of trying to guess whether the second buffer needs to be freed
    set a flag at the place it is allocated
    
    (cherry picked from commit ab09bf616ad527b249aca5f2a4956fd526f0712f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c6ce0dadcfd14973ba880f4e043058a9367f00ce

commit c6ce0dadcfd14973ba880f4e043058a9367f00ce
Author: Ondřej Bílka <neleai@seznam.cz>
Date:   Sun Feb 16 12:59:23 2014 +0100

    Deduplicate resolv/nss_dns/dns-host.c
    
    In resolv/nss_dns/dns-host.c one of code path duplicated code after
    that. We merge these paths.
    
    (cherry picked from commit ab7ac0f2cf8731fe4c3f3aea6088a7c0127b5725)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73

commit 4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu Feb 13 11:01:57 2014 +0100

    Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    (cherry picked from commit d668061994a7486a3ba9c7d5e7882d85a2883707)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=00a84253c5bc7dffb7a0a666cea21ea5e0288771

commit 00a84253c5bc7dffb7a0a666cea21ea5e0288771
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu May 8 16:53:01 2014 +0200

    Fix unbound stack use in NIS NSS module
    
    (cherry picked from commit 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=30026b69015db3f82407df83dc1118518ee1fa5c

commit 30026b69015db3f82407df83dc1118518ee1fa5c
Author: Allan McRae <allan@archlinux.org>
Date:   Sat Jun 21 17:23:55 2014 +1000

    Mention CVE-2014-4043 in NEWS
    
    (cherry picked from commit d03efb2f979defd473955a455d66b949961d26b2)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa

commit e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Jun 11 23:12:52 2014 +0200

    posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
    
    POSIX requires that we make a copy, so we allocate a new string
    and free it in posix_spawn_file_actions_destroy.
    
    Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz.  This bug
    may have security implications.
    
    (cherry picked from commit 89e435f3559c53084498e9baad22172b64429362)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------
Comment 10 cvs-commit@gcc.gnu.org 2014-08-28 12:02:05 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, allan/2.19/backport has been created
        at  d75d95a7f2823ec2cf90b5fa7dafef283f49401e (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d75d95a7f2823ec2cf90b5fa7dafef283f49401e

commit d75d95a7f2823ec2cf90b5fa7dafef283f49401e
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 26 19:38:59 2014 +0200

    __gconv_translit_find: Disable function [BZ #17187]
    
    This functionality has never worked correctly, and the implementation
    contained a security vulnerability (CVE-2014-5119).
    
    (cherry picked from commit a1a6a401ab0a3c9f15fb7eaebbdcee24192254e8)
    (cherry picked from commit f9df71e895d3552d557e783fdb9d133328195645)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a27eb3cfcc0cdcbf197c66bbf78ff1ec84412f22

commit a27eb3cfcc0cdcbf197c66bbf78ff1ec84412f22
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Fri Aug 1 09:48:17 2014 +0200

    NEWS: Explain the s390 jmp_buf / ucontext_t ABI change reversal.
    
    (cherry picked from commit 95ee7fb13ba99ba265b49531c57e1cb8db629bc6)
    
    Typo fix as in commit 45ef66289acbab17278a73512f9b2a9d8a7ca79d and
    NEW enty adjusted to reflect revert occuring in 2.19.1 and 2.20.
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=19392a8ff30c913a35574f2b0875f61dfb78af46

commit 19392a8ff30c913a35574f2b0875f61dfb78af46
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Thu Aug 28 16:53:13 2014 +1000

    S/390: Revert the jmp_buf/ucontext_t ABI change
    
    Backport of commit 2f438e20ab591641760e97458d5d1569942eced5

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a5dd31f514e3ab41bfe60cdeacd75d875006d9cc

commit a5dd31f514e3ab41bfe60cdeacd75d875006d9cc
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:05:03 2014 +0200

    manual: Update the locale documentation
    
    (cherry picked from commit 585367266923156ac6fb789939a923641ba5aaf4)
    
    Conflicts:
    	manual/locale.texi

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d475d58097efe764e2567fca0ea194d5d80150ce

commit d475d58097efe764e2567fca0ea194d5d80150ce
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon May 12 15:24:12 2014 +0200

    _nl_find_locale: Improve handling of crafted locale names [BZ #17137]
    
    Prevent directory traversal in locale-related environment variables
    (CVE-2014-0475).
    
    (cherry picked from commit 4e8f95a0df7c2300b830ec12c0ae1e161bc8a8a3)
    
    Conflicts:
    	NEWS
    	localedata/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1298cdbed6596663785254f63cb92af265aee8e0

commit 1298cdbed6596663785254f63cb92af265aee8e0
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:41:52 2014 +0200

    setlocale: Use the heap for the copy of the locale argument
    
    This avoids alloca calls with potentially large arguments.
    
    (cherry picked from commit d183645616b0533b3acee28f1a95570bffbdf50f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5754d77ab9899688380da1a52b02f62815b3d34b

commit 5754d77ab9899688380da1a52b02f62815b3d34b
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Mon May 26 11:40:08 2014 +0530

    Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (BZ #16878)
    
    The netgroups nss modules in the glibc tree use NSS_STATUS_UNAVAIL
    (with errno as ERANGE) when the supplied buffer does not have
    sufficient space for the result.  This is wrong, because the canonical
    way to indicate insufficient buffer is to set the errno to ERANGE and
    the status to NSS_STATUS_TRYAGAIN, as is used by all other modules.
    
    This fixes nscd behaviour when the nss_ldap module returns
    NSS_STATUS_TRYAGAIN to indicate that a netgroup entry is too long to
    fit into the supplied buffer.
    
    (cherry picked from commit c3ec475c5dd16499aa040908e11d382c3ded9692)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b5a823c6c62a05a793aa2d6ff208d1261b46f281

commit b5a823c6c62a05a793aa2d6ff208d1261b46f281
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed Mar 12 17:27:22 2014 +0530

    Provide correct buffer length to netgroup queries in nscd (BZ #16695)
    
    The buffer to query netgroup entries is allocated sufficient space for
    the netgroup entries and the key to be appended at the end, but it
    sends in an incorrect available length to the NSS netgroup query
    functions, resulting in overflow of the buffer in some special cases.
    The fix here is to factor in the key length when sending the available
    buffer and buffer length to the query functions.
    
    (cherry picked from commit c44496df2f090a56d3bf75df930592dac6bba46f)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9c4b0856b5627d443edc924ae972a27078c53112

commit 9c4b0856b5627d443edc924ae972a27078c53112
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 20 21:52:53 2014 +0100

    [BZ #16046] dl_iterate_phdr static executable test
    
    (cherry picked from commit 257ce7127e2f64a6a959b146786cd43de0e42b5f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5ec38d177c9089db1bc62546bfaf411c0cabeb6d

commit 5ec38d177c9089db1bc62546bfaf411c0cabeb6d
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 20 12:41:27 2014 +0200

    Fix another memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit aa6ec754f3b4b1df81d186480c534b6486a1e6ee)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4498c0516d9f16feeca46820ba8ca2e62f916f82

commit 4498c0516d9f16feeca46820ba8ca2e62f916f82
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu Jun 19 15:38:03 2014 +0200

    Fix memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit 4d43ef1e7434d7d419afbcd754931cb0c794763c)
    
    Conflicts:
    	posix/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7b17d60f13089585c2b63d46cbc660c4b85d169d

commit 7b17d60f13089585c2b63d46cbc660c4b85d169d
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    (cherry picked from commit f9d2d03254a58d92635a311a42253eeed5a40a47)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=76aebfbb87ecc33e59d29a8adda76dfcdbc9213d

commit 76aebfbb87ecc33e59d29a8adda76dfcdbc9213d
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Feb 18 10:57:25 2014 +0100

    Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    Instead of trying to guess whether the second buffer needs to be freed
    set a flag at the place it is allocated
    
    (cherry picked from commit ab09bf616ad527b249aca5f2a4956fd526f0712f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c6ce0dadcfd14973ba880f4e043058a9367f00ce

commit c6ce0dadcfd14973ba880f4e043058a9367f00ce
Author: Ondřej Bílka <neleai@seznam.cz>
Date:   Sun Feb 16 12:59:23 2014 +0100

    Deduplicate resolv/nss_dns/dns-host.c
    
    In resolv/nss_dns/dns-host.c one of code path duplicated code after
    that. We merge these paths.
    
    (cherry picked from commit ab7ac0f2cf8731fe4c3f3aea6088a7c0127b5725)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73

commit 4ad0ab7bdb6c4afb3fc561c6497759eb939d2a73
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu Feb 13 11:01:57 2014 +0100

    Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    (cherry picked from commit d668061994a7486a3ba9c7d5e7882d85a2883707)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=00a84253c5bc7dffb7a0a666cea21ea5e0288771

commit 00a84253c5bc7dffb7a0a666cea21ea5e0288771
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu May 8 16:53:01 2014 +0200

    Fix unbound stack use in NIS NSS module
    
    (cherry picked from commit 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=30026b69015db3f82407df83dc1118518ee1fa5c

commit 30026b69015db3f82407df83dc1118518ee1fa5c
Author: Allan McRae <allan@archlinux.org>
Date:   Sat Jun 21 17:23:55 2014 +1000

    Mention CVE-2014-4043 in NEWS
    
    (cherry picked from commit d03efb2f979defd473955a455d66b949961d26b2)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa

commit e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Jun 11 23:12:52 2014 +0200

    posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
    
    POSIX requires that we make a copy, so we allocate a new string
    and free it in posix_spawn_file_actions_destroy.
    
    Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz.  This bug
    may have security implications.
    
    (cherry picked from commit 89e435f3559c53084498e9baad22172b64429362)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------
Comment 11 cvs-commit@gcc.gnu.org 2014-09-05 13:16:28 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.19/master has been updated
       via  daea1a9b2ab9ad1690a2770006f5964e188be11f (commit)
       via  b8d0acdb33866d0f67ee8a019bdbdaa6a00d0c99 (commit)
       via  92b410973f872297e0c1bfda06abead4b0a265d1 (commit)
       via  424f645c513d56a5b8323971197e3afa1ed8f003 (commit)
       via  75f66fe467b280d9fb192d3f32e06e4b20d12dcc (commit)
       via  ac39af9f195138a01b836fb4a30bd971de4aa163 (commit)
       via  2da15d05c54738ed2c53aaf555c7cf51a9057844 (commit)
       via  6ccc1c41f52f93548b5eb64d106219e287052472 (commit)
       via  4e27332819b6151ccb5031d0efd718d802168573 (commit)
       via  9583c3542133be925467c87df7f74882783d867d (commit)
       via  2ce47f454b6f1df5d2374fcac1b72e65e5f55a67 (commit)
       via  1f542fe398a1d02cce53d78f7a33e72078e7d4e9 (commit)
       via  d3b2d64576fcc1281841a48740f5f481d1b46a90 (commit)
       via  40da893a143224b0a41a004eb5e971fc5d94381b (commit)
       via  3a4f226eaf6aff5529711f7fa3885a1cec815c32 (commit)
       via  efbeb31ba5277132b683011714f8e77bc2156aa2 (commit)
       via  968b59ad2aecdbe67ac5016c395a7e38fd682bb7 (commit)
       via  29fd33140d964e0e08207ceecbf479b85658fcb8 (commit)
       via  8ec14bdc9c600cc273b242ebca6566fe15de107d (commit)
       via  e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa (commit)
      from  344e61df0200af758e794b9843ffb37bd89e5259 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=daea1a9b2ab9ad1690a2770006f5964e188be11f

commit daea1a9b2ab9ad1690a2770006f5964e188be11f
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Sep 3 19:45:43 2014 +0200

    CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]
    
    These changes are based on the fix for BZ #14134 in commit
    6e230d11837f3ae7b375ea69d7905f0d18eb79e5.
    
    (cherry picked from commit 41488498b6d9440ee66ab033808cce8323bba7ac)
    
    Conflicts:
    	NEWS
    	iconvdata/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b8d0acdb33866d0f67ee8a019bdbdaa6a00d0c99

commit b8d0acdb33866d0f67ee8a019bdbdaa6a00d0c99
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Aug 26 19:38:59 2014 +0200

    __gconv_translit_find: Disable function [BZ #17187]
    
    This functionality has never worked correctly, and the implementation
    contained a security vulnerability (CVE-2014-5119).
    
    (cherry picked from commit a1a6a401ab0a3c9f15fb7eaebbdcee24192254e8)
    (cherry picked from commit f9df71e895d3552d557e783fdb9d133328195645)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=92b410973f872297e0c1bfda06abead4b0a265d1

commit 92b410973f872297e0c1bfda06abead4b0a265d1
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Fri Aug 1 09:48:17 2014 +0200

    NEWS: Explain the s390 jmp_buf / ucontext_t ABI change reversal.
    
    (cherry picked from commit 95ee7fb13ba99ba265b49531c57e1cb8db629bc6)
    
    Typo fix as in commit 45ef66289acbab17278a73512f9b2a9d8a7ca79d and
    NEW enty adjusted to reflect revert occuring in 2.19.1 and 2.20.
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=424f645c513d56a5b8323971197e3afa1ed8f003

commit 424f645c513d56a5b8323971197e3afa1ed8f003
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Thu Aug 28 16:53:13 2014 +1000

    S/390: Revert the jmp_buf/ucontext_t ABI change
    
    Backport of commit 2f438e20ab591641760e97458d5d1569942eced5

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=75f66fe467b280d9fb192d3f32e06e4b20d12dcc

commit 75f66fe467b280d9fb192d3f32e06e4b20d12dcc
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:05:03 2014 +0200

    manual: Update the locale documentation
    
    (cherry picked from commit 585367266923156ac6fb789939a923641ba5aaf4)
    
    Conflicts:
    	manual/locale.texi

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ac39af9f195138a01b836fb4a30bd971de4aa163

commit ac39af9f195138a01b836fb4a30bd971de4aa163
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon May 12 15:24:12 2014 +0200

    _nl_find_locale: Improve handling of crafted locale names [BZ #17137]
    
    Prevent directory traversal in locale-related environment variables
    (CVE-2014-0475).
    
    (cherry picked from commit 4e8f95a0df7c2300b830ec12c0ae1e161bc8a8a3)
    
    Addiational backporting fixes:
      Added tst-setlocale3-ENV to localedata/Makefile
    
    Conflicts:
    	NEWS
    	localedata/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2da15d05c54738ed2c53aaf555c7cf51a9057844

commit 2da15d05c54738ed2c53aaf555c7cf51a9057844
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed May 28 14:41:52 2014 +0200

    setlocale: Use the heap for the copy of the locale argument
    
    This avoids alloca calls with potentially large arguments.
    
    (cherry picked from commit d183645616b0533b3acee28f1a95570bffbdf50f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6ccc1c41f52f93548b5eb64d106219e287052472

commit 6ccc1c41f52f93548b5eb64d106219e287052472
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Mon May 26 11:40:08 2014 +0530

    Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (BZ #16878)
    
    The netgroups nss modules in the glibc tree use NSS_STATUS_UNAVAIL
    (with errno as ERANGE) when the supplied buffer does not have
    sufficient space for the result.  This is wrong, because the canonical
    way to indicate insufficient buffer is to set the errno to ERANGE and
    the status to NSS_STATUS_TRYAGAIN, as is used by all other modules.
    
    This fixes nscd behaviour when the nss_ldap module returns
    NSS_STATUS_TRYAGAIN to indicate that a netgroup entry is too long to
    fit into the supplied buffer.
    
    (cherry picked from commit c3ec475c5dd16499aa040908e11d382c3ded9692)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4e27332819b6151ccb5031d0efd718d802168573

commit 4e27332819b6151ccb5031d0efd718d802168573
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed Mar 12 17:27:22 2014 +0530

    Provide correct buffer length to netgroup queries in nscd (BZ #16695)
    
    The buffer to query netgroup entries is allocated sufficient space for
    the netgroup entries and the key to be appended at the end, but it
    sends in an incorrect available length to the NSS netgroup query
    functions, resulting in overflow of the buffer in some special cases.
    The fix here is to factor in the key length when sending the available
    buffer and buffer length to the query functions.
    
    (cherry picked from commit c44496df2f090a56d3bf75df930592dac6bba46f)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9583c3542133be925467c87df7f74882783d867d

commit 9583c3542133be925467c87df7f74882783d867d
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 20 21:52:53 2014 +0100

    [BZ #16046] dl_iterate_phdr static executable test
    
    (cherry picked from commit 257ce7127e2f64a6a959b146786cd43de0e42b5f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2ce47f454b6f1df5d2374fcac1b72e65e5f55a67

commit 2ce47f454b6f1df5d2374fcac1b72e65e5f55a67
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 20 12:41:27 2014 +0200

    Fix another memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit aa6ec754f3b4b1df81d186480c534b6486a1e6ee)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1f542fe398a1d02cce53d78f7a33e72078e7d4e9

commit 1f542fe398a1d02cce53d78f7a33e72078e7d4e9
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu Jun 19 15:38:03 2014 +0200

    Fix memory leak in regexp compiler (BZ #17069)
    
    (cherry picked from commit 4d43ef1e7434d7d419afbcd754931cb0c794763c)
    
    Conflicts:
    	posix/Makefile

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d3b2d64576fcc1281841a48740f5f481d1b46a90

commit d3b2d64576fcc1281841a48740f5f481d1b46a90
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    (cherry picked from commit f9d2d03254a58d92635a311a42253eeed5a40a47)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=40da893a143224b0a41a004eb5e971fc5d94381b

commit 40da893a143224b0a41a004eb5e971fc5d94381b
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Feb 18 10:57:25 2014 +0100

    Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    Instead of trying to guess whether the second buffer needs to be freed
    set a flag at the place it is allocated
    
    (cherry picked from commit ab09bf616ad527b249aca5f2a4956fd526f0712f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3a4f226eaf6aff5529711f7fa3885a1cec815c32

commit 3a4f226eaf6aff5529711f7fa3885a1cec815c32
Author: Ondřej Bílka <neleai@seznam.cz>
Date:   Sun Feb 16 12:59:23 2014 +0100

    Deduplicate resolv/nss_dns/dns-host.c
    
    In resolv/nss_dns/dns-host.c one of code path duplicated code after
    that. We merge these paths.
    
    (cherry picked from commit ab7ac0f2cf8731fe4c3f3aea6088a7c0127b5725)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=efbeb31ba5277132b683011714f8e77bc2156aa2

commit efbeb31ba5277132b683011714f8e77bc2156aa2
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu Feb 13 11:01:57 2014 +0100

    Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
    
    (cherry picked from commit d668061994a7486a3ba9c7d5e7882d85a2883707)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=968b59ad2aecdbe67ac5016c395a7e38fd682bb7

commit 968b59ad2aecdbe67ac5016c395a7e38fd682bb7
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu May 8 16:53:01 2014 +0200

    Fix unbound stack use in NIS NSS module
    
    (cherry picked from commit 315eb1d86aea489cd6325fd1c2521dcfb4fc0e1c)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=29fd33140d964e0e08207ceecbf479b85658fcb8

commit 29fd33140d964e0e08207ceecbf479b85658fcb8
Author: Allan McRae <allan@archlinux.org>
Date:   Sat Jun 21 17:23:55 2014 +1000

    Mention CVE-2014-4043 in NEWS
    
    (cherry picked from commit d03efb2f979defd473955a455d66b949961d26b2)
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8ec14bdc9c600cc273b242ebca6566fe15de107d

commit 8ec14bdc9c600cc273b242ebca6566fe15de107d
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Thu Jun 12 14:15:25 2014 +0200

    posix_spawn_faction_addopen: Add missing string.h include directive
    
    This is needed to avoid a PLT call on s390.
    
    (cherry picked from commit 35a5e3e338ae17f3d42c60a708763c5d498fb840)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa

commit e698ea2c03ddfdfa87459c1a0e53e2a4289de0fa
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Jun 11 23:12:52 2014 +0200

    posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
    
    POSIX requires that we make a copy, so we allocate a new string
    and free it in posix_spawn_file_actions_destroy.
    
    Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz.  This bug
    may have security implications.
    
    (cherry picked from commit 89e435f3559c53084498e9baad22172b64429362)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |  247 ++++++++++++++++++++
 NEWS                                               |   40 +++-
 elf/Makefile                                       |    2 +-
 elf/tst-dl-iter-static.c                           |   47 ++++
 iconv/gconv_trans.c                                |  177 +--------------
 iconvdata/Makefile                                 |    1 +
 iconvdata/ibm1364.c                                |    3 +-
 iconvdata/ibm932.c                                 |    5 +-
 iconvdata/ibm933.c                                 |    2 +-
 iconvdata/ibm935.c                                 |    2 +-
 iconvdata/ibm937.c                                 |    2 +-
 iconvdata/ibm939.c                                 |    2 +-
 iconvdata/ibm943.c                                 |    5 +-
 iconvdata/run-iconv-test.sh                        |   18 ++
 include/resolv.h                                   |    6 +-
 locale/findlocale.c                                |   74 +++++-
 locale/setlocale.c                                 |   14 +-
 localedata/ChangeLog                               |    6 +
 localedata/Makefile                                |    5 +-
 localedata/tst-setlocale3.c                        |  203 ++++++++++++++++
 manual/locale.texi                                 |  146 +++++++++---
 nis/nss_nis/nis-hosts.c                            |   14 ++
 nis/nss_nis/nis-initgroups.c                       |    7 +
 nis/nss_nis/nis-network.c                          |    7 +
 nis/nss_nis/nis-service.c                          |   14 ++
 nptl/sysdeps/unix/sysv/linux/s390/pt-longjmp.c     |   71 ++----
 nscd/netgroupcache.c                               |   16 +-
 nss/nss_files/files-netgrp.c                       |    2 +-
 posix/Makefile                                     |   10 +-
 posix/bug-regex36.c                                |   29 +++
 posix/regcomp.c                                    |   19 ++-
 posix/spawn_faction_addopen.c                      |   14 +-
 posix/spawn_faction_destroy.c                      |   22 ++-
 posix/spawn_int.h                                  |    2 +-
 posix/tst-spawn.c                                  |   10 +-
 resolv/gethnamaddr.c                               |    6 +-
 resolv/nss_dns/dns-canon.c                         |    2 +-
 resolv/nss_dns/dns-host.c                          |   32 ++--
 resolv/nss_dns/dns-network.c                       |    4 +-
 resolv/res_query.c                                 |   45 ++--
 resolv/res_send.c                                  |   22 ++-
 sysdeps/s390/Makefile                              |    9 -
 sysdeps/s390/Versions                              |    6 +-
 sysdeps/s390/__longjmp.c                           |   31 ---
 sysdeps/s390/bits/setjmp.h                         |    4 -
 sysdeps/s390/longjmp.c                             |   68 ++----
 sysdeps/s390/rtld-__longjmp.c                      |   19 --
 sysdeps/s390/rtld-global-offsets.sym               |    7 -
 sysdeps/s390/rtld-setjmp.S                         |   20 --
 sysdeps/s390/s390-32/__longjmp-common.c            |   68 ------
 sysdeps/s390/s390-32/__longjmp.c                   |   68 ++++++
 sysdeps/s390/s390-32/setjmp-common.S               |   84 -------
 sysdeps/s390/s390-32/setjmp.S                      |  111 +++++++++
 sysdeps/s390/s390-64/__longjmp-common.c            |   74 ------
 sysdeps/s390/s390-64/__longjmp.c                   |   74 ++++++
 sysdeps/s390/s390-64/setjmp-common.S               |   79 -------
 sysdeps/s390/s390-64/setjmp.S                      |  106 +++++++++
 sysdeps/s390/setjmp.S                              |   64 -----
 sysdeps/s390/sigjmp.c                              |   34 ---
 sysdeps/s390/v1-longjmp.c                          |   57 -----
 sysdeps/s390/v1-setjmp.h                           |  111 ---------
 sysdeps/s390/v1-sigjmp.c                           |   44 ----
 sysdeps/unix/sysv/linux/s390/Makefile              |    6 -
 sysdeps/unix/sysv/linux/s390/getcontext.S          |   38 ---
 sysdeps/unix/sysv/linux/s390/longjmp_chk.c         |   36 ++--
 sysdeps/unix/sysv/linux/s390/rtld-getcontext.S     |   19 --
 .../unix/sysv/linux/s390/s390-32/____longjmp_chk.c |   24 +--
 .../sysv/linux/s390/s390-32/getcontext-common.S    |  112 ---------
 sysdeps/unix/sysv/linux/s390/s390-32/getcontext.S  |   86 +++++++
 .../unix/sysv/linux/s390/s390-32/nptl/libc.abilist |    1 -
 sysdeps/unix/sysv/linux/s390/s390-32/setcontext.S  |   10 +-
 sysdeps/unix/sysv/linux/s390/s390-32/swapcontext.S |   24 +--
 .../unix/sysv/linux/s390/s390-32/ucontext_i.sym    |   26 --
 .../unix/sysv/linux/s390/s390-64/____longjmp_chk.c |   25 +--
 .../sysv/linux/s390/s390-64/getcontext-common.S    |   79 -------
 sysdeps/unix/sysv/linux/s390/s390-64/getcontext.S  |   86 +++++++
 .../unix/sysv/linux/s390/s390-64/nptl/libc.abilist |    1 -
 sysdeps/unix/sysv/linux/s390/s390-64/swapcontext.S |   14 +-
 sysdeps/unix/sysv/linux/s390/sys/ucontext.h        |   13 -
 .../sysv/linux/s390/{s390-64 => }/ucontext_i.sym   |    0
 sysdeps/unix/sysv/linux/s390/v1-longjmp_chk.c      |   35 ---
 81 files changed, 1598 insertions(+), 1530 deletions(-)
 create mode 100644 elf/tst-dl-iter-static.c
 create mode 100644 localedata/tst-setlocale3.c
 create mode 100644 posix/bug-regex36.c
 delete mode 100644 sysdeps/s390/Makefile
 delete mode 100644 sysdeps/s390/__longjmp.c
 delete mode 100644 sysdeps/s390/rtld-__longjmp.c
 delete mode 100644 sysdeps/s390/rtld-global-offsets.sym
 delete mode 100644 sysdeps/s390/rtld-setjmp.S
 delete mode 100644 sysdeps/s390/s390-32/__longjmp-common.c
 create mode 100644 sysdeps/s390/s390-32/__longjmp.c
 delete mode 100644 sysdeps/s390/s390-32/setjmp-common.S
 create mode 100644 sysdeps/s390/s390-32/setjmp.S
 delete mode 100644 sysdeps/s390/s390-64/__longjmp-common.c
 create mode 100644 sysdeps/s390/s390-64/__longjmp.c
 delete mode 100644 sysdeps/s390/s390-64/setjmp-common.S
 create mode 100644 sysdeps/s390/s390-64/setjmp.S
 delete mode 100644 sysdeps/s390/setjmp.S
 delete mode 100644 sysdeps/s390/sigjmp.c
 delete mode 100644 sysdeps/s390/v1-longjmp.c
 delete mode 100644 sysdeps/s390/v1-setjmp.h
 delete mode 100644 sysdeps/s390/v1-sigjmp.c
 delete mode 100644 sysdeps/unix/sysv/linux/s390/getcontext.S
 delete mode 100644 sysdeps/unix/sysv/linux/s390/rtld-getcontext.S
 delete mode 100644 sysdeps/unix/sysv/linux/s390/s390-32/getcontext-common.S
 create mode 100644 sysdeps/unix/sysv/linux/s390/s390-32/getcontext.S
 delete mode 100644 sysdeps/unix/sysv/linux/s390/s390-32/ucontext_i.sym
 delete mode 100644 sysdeps/unix/sysv/linux/s390/s390-64/getcontext-common.S
 create mode 100644 sysdeps/unix/sysv/linux/s390/s390-64/getcontext.S
 rename sysdeps/unix/sysv/linux/s390/{s390-64 => }/ucontext_i.sym (100%)
 delete mode 100644 sysdeps/unix/sysv/linux/s390/v1-longjmp_chk.c
Comment 12 cvs-commit@gcc.gnu.org 2014-09-07 12:13:38 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The annotated tag, glibc-2.20 has been created
        at  9bcede1abfb0fa62d54b7cfce5c72d56e2f7b95c (tag)
   tagging  b8079dd0d360648e4e8de48656c5c38972621072 (commit)
  replaces  glibc-2.19
 tagged by  Allan McRae
        on  Sun Sep 7 18:17:29 2014 +1000

- Log -----------------------------------------------------------------
The GNU C Library
=================

The GNU C Library version 2.20 is now available.

The GNU C Library is used as *the* C library in the GNU systems
and is widely used on systems with the Linux kernel.

The GNU C Library is primarily designed to be a portable
and high performance C library.  It follows all relevant
standards including ISO C11 and POSIX.1-2008.  It is also
internationalized and has one of the most complete
internationalization interfaces known.

The GNU C Library webpage is at http://www.gnu.org/software/libc/

Packages for the 2.20 release may be downloaded from:
        http://ftpmirror.gnu.org/libc/
        http://ftp.gnu.org/gnu/libc/

The mirror list is at http://www.gnu.org/order/ftp.html

NEWS for version 2.20
====================

* The following bugs are resolved with this release:

  6804, 9894, 12994, 13347, 13651, 14308, 14770, 15119, 15132, 15347, 15514,
  15698, 15804, 15894, 15946, 16002, 16064, 16095, 16194, 16198, 16275,
  16284, 16287, 16315, 16348, 16349, 16354, 16357, 16362, 16447, 16516,
  16532, 16539, 16545, 16561, 16562, 16564, 16574, 16599, 16600, 16609,
  16610, 16611, 16613, 16619, 16623, 16629, 16632, 16634, 16639, 16642,
  16648, 16649, 16670, 16674, 16677, 16680, 16681, 16683, 16689, 16695,
  16701, 16706, 16707, 16712, 16713, 16714, 16724, 16731, 16739, 16740,
  16743, 16754, 16758, 16759, 16760, 16770, 16786, 16789, 16791, 16796,
  16799, 16800, 16815, 16823, 16824, 16831, 16838, 16839, 16849, 16854,
  16876, 16877, 16878, 16882, 16885, 16888, 16890, 16892, 16912, 16915,
  16916, 16917, 16918, 16922, 16927, 16928, 16932, 16943, 16958, 16965,
  16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
  17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
  17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
  17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354.

* Reverted change of ABI data structures for s390 and s390x:
  On s390 and s390x the size of struct ucontext and jmp_buf was increased in
  2.19. This change is reverted in 2.20. The introduced 2.19 symbol versions
  of getcontext, setjmp, _setjmp, __sigsetjmp, longjmp, _longjmp, siglongjmp
  are preserved pointing straight to the same implementation as the old ones.
  Given that, new callers will simply provide a too-big buffer to these
  functions. Any applications/libraries out there that embed jmp_buf or
  ucontext_t in an ABI-relevant data structure that have already been rebuilt
  against 2.19 headers will have to rebuilt again. This is necessary in any
  case to revert the breakage in their ABI caused by the glibc change.

* Support for file description locks is added to systems running the
  Linux kernel. The standard file locking interfaces are extended to
  operate on file descriptions, not file descriptors, via the use of
  F_OFD_GETLK, F_OFD_SETLK, and F_OFD_SETLKW. File description locks
  are associated with an open file instead of a process.

* Optimized strchr implementation for AArch64.  Contributed by ARM Ltd.

* The minimum Linux kernel version that this version of the GNU C Library
  can be used with is 2.6.32.

* Running the testsuite no longer terminates as soon as a test fails.
  Instead, a file tests.sum (xtests.sum from "make xcheck") is generated,
  with PASS or FAIL lines for individual tests.  A summary of the results is
  printed, including a list of failing lists, and "make check" exits with
  error status if there were any unexpected failures.  "make check
  stop-on-test-failure=y" may be used to keep the old behavior.

* The am33 port, which had not worked for several years, has been removed
  from ports.

* The _BSD_SOURCE and _SVID_SOURCE feature test macros are no longer
  supported; they now act the same as _DEFAULT_SOURCE (but generate a
  warning).  Except for cases where _BSD_SOURCE enabled BSD interfaces that
  conflicted with POSIX (support for which was removed in 2.19), the
  interfaces those macros enabled remain available when compiling with
  _GNU_SOURCE defined, with _DEFAULT_SOURCE defined, or without any feature
  test macros defined.

* Optimized strcmp implementation for ARMv7.  Contributed by ARM Ltd.

* Added support for TX lock elision of pthread mutexes on s390 and s390x.
  This may improve lock scaling of existing programs on TX capable systems.
  The lock elision code is only built with --enable-lock-elision=yes and
  then requires a GCC version supporting the TX builtins.  With lock elision
  default mutexes are elided via __builtin_tbegin, if the cpu supports
  transactions. By default lock elision is not enabled and the elision code
  is not built.

* CVE-2014-4043 The posix_spawn_file_actions_addopen implementation did not
  copy the path argument.  This allowed programs to cause posix_spawn to
  deference a dangling pointer, or use an unexpected pathname argument if
  the string was modified after the posix_spawn_file_actions_addopen
  invocation.

* All supported architectures now use the main glibc sysdeps directory
  instead of some being in a separate "ports" directory (which was
  distributed separately before glibc 2.17).

* The NPTL implementation of POSIX pthreads is no longer an "add-on".
  On configurations that support it (all Linux configurations), it's now
  used regardless of the --enable-add-ons switch to configure.  It is no
  longer possible to build such configurations without pthreads support.

* Locale names, including those obtained from environment variables (LANG
  and the LC_* variables), are more tightly checked for proper syntax.
  setlocale will now fail (with EINVAL) for locale names that are overly
  long, contain slashes without starting with a slash, or contain ".." path
  components. (CVE-2014-0475)  Previously, some valid locale names were
  silently replaced with the "C" locale when running in AT_SECURE mode
  (e.g., in a SUID program).  This is no longer necessary because of the
  additional checks.

* On x86-64, the dynamic linker's lazy-binding support is now compatible
  with application code using Intel MPX instructions.  (With all previous
  versions, the MPX register state could be clobbered when making calls
  into or out of a shared library.)  Note that while the new dynamic
  linker is compatible with all known x86 hardware whether or not it
  supports Intel MPX, some x86 instruction-set emulators might fail to
  handle the new instruction encodings.  This is known to affect Valgrind
  versions up through 3.9 (but will be fixed in the forthcoming 3.10
  release), and might affect other tools that do instruction emulation.

* Support for loadable gconv transliteration modules has been removed.
  The support for transliteration modules has been non-functional for
  over a decade, and the removal is prompted by security defects.  The
  normal gconv conversion modules are still supported.  Transliteration
  with //TRANSLIT is still possible, and the //IGNORE specifier
  continues to be  supported. (CVE-2014-5119)

* Decoding a crafted input sequence in the character sets IBM933, IBM935,
  IBM937, IBM939, IBM1364 could result in an out-of-bounds array read,
  resulting a denial-of-service security vulnerability in applications which
  use functions related to iconv. (CVE-2014-6040)

Contributors
============

This release was made possible by the contributions of many people.
The maintainers are grateful to everyone who has contributed
changes or bug reports.  These include:

Adam Conrad
Adhemerval Zanella
Alan Modra
Allan McRae
Andi Kleen
Andreas Krebbel
Andreas Schwab
Arjun Shankar
Aurelien Jarno
Bernard Ogden
Carlos O'Donell
Chris Metcalf
David Holsgrove
David S. Miller
David Svoboda
Dominik Vogt
Dylan Alex Simon
Eric Wong
Florian Weimer
Guo Yixuan
H.J. Lu
Ian Bolton
Igor Zamyatin
Jeff Layton
Jim Meyering
Joey Ye
Jose E. Marchesi
Joseph Anthony Pasquale Holsten
Joseph Myers
Julian Brown
Khem Raj
Konstantin Serebryany
Kyle McMartin
Ling Ma
Ludovic Courtès
Maciej W. Rozycki
Marcus Shawcroft
Mark Wielaard
Marko Myllynen
Meador Inge
Mike Frysinger
Ondřej Bílka
Paul Eggert
Paul Pluzhnikov
Peter TB Brett
Rajalakshmi Srinivasaraghavan
Rasmus Villemoes
Richard Earnshaw
Richard Henderson
Roland McGrath
Sami Kerola
Samuel Thibault
Sean Anderson
Serge Hallyn
Siddhesh Poyarekar
Sihai Yao
Stefan Liebler
Steve Ellcey
Tomas Dohnalek
Torvald Riegel
Venkataramanan Kumar
Vidya Ranganathan
Wilco
Wilco Dijkstra
Will Newton
Yang Yingliang
Yufeng Zhang
Yury Gribov
Yvan Roux
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAABAgAGBQJUDBTZAAoJEPmf/g/q6Zm99pwH/1dlaqMxZ1SB7Nzk1C95URs+
AOihIh+Q5EYgqD3GnYp/evfMaHzZN7TTncZLXmDq6Ui7UiafYddFL91x06q/NzWN
veCipwZC/RgCtQmEAkonVeREKauYrA4OGar86cU3HCIrpG2lGs/QXlhjvB/0HEay
3EJR90lARmZTjFX6nx78uiAzlpfPWhOiallr+Q6WTO4LSyIsf5obyaTNGNWAmWIj
uotYaWjHr+cLwmiYxgO+6JuSOv7HxutnNer82hCH+k/2ppXyIh5RjqRbvbZFscax
VNnfC5Hg/khzZdVXZXowAOkDvLagiQIwSHfTep80p5NeP+aJ2A+CK1ARYY0y8ts=
=Yk2q
-----END PGP SIGNATURE-----

Adam Conrad (2):
      Allow sys/auxv.h to be used from the testsuite on powerpc and sparc.
      Revert incorrect removal of the XDR currency from locale/iso-4217.def

Adhemerval Zanella (68):
      PowerPC: Update powerpc-fpu ULPs.
      PowerPC: Optimized isnan/isnanf for POWER8
      PowerPC: Optimized isinf/isinff for POWER8
      PowerPC: Optimized finite/finitef for POWER8
      PowerPC: llrint/llrintf POWER8 optimization
      PowerPC: llround/llroundf POWER8 optimization
      PowerPC: Update powerpc-fpu ULPs.
      PowerPC: Fix modf/modff optimization return sign
      PowerPC: strncat optimization for PPC64
      PowerPC: Fix bzero definition for static libc for PPC64
      PowerPC: Fix strspn for static build
      PowerPC: Fix bzero definition for static libc for PPC32
      Add truncl tests related to BZ#16414
      PowerPC: remove wrong ceill implementation for PowerPC64
      PowerPC: remove wrong nearbyintl implementation for PPC64
      PowerPC: remove wrong roundl implementation for PowerPC64
      Add stardard definition on conform processing
      PowerPC: optimized strcspn for PPC64/POWER7
      PowerPC: optimized strpbrk for POWER7
      PowerPC: Fix -Wundef warning for __PTHREAD_MUTEX_HAVE_ELISION.
      Update powerpc-fpu ULPs.
      PowerPC: Revert __PTHREAD_MUTEX_HAVE_ELISION change
      Fix localplt check for GNU_IFUNC
      PowerPC: Fix little endian enconding for mfvsrd
      PowerPC: Fix nearbyint/nearbyintf result for FE_DOWNWARD
      PowerPC: define _CALL_ELF if compiler does not
      PowerPC: Fix --disable-multi-arch builds
      Move __PTHREAD_SPINS definition to architecture specific header
      Define _STRING_ARCH_unaligned unconditionally
      PowerPC: Add fenv macros for long double
      PowerPC: Sync pthread_once with default implementation
      PowerPC: Suppress unnecessary FPSCR write
      Fix
      More fixes for unsafe compiler optimization
      PowerPC: ifunc improvement for internal calls
      Fix elf/tst-tls9-static build
      PowerPC: clean BSD Terminal Modes expectation in termios.h
      PowerPC: Fix multiarch hypotf PPC64 path
      PowerPC: Fix copysignf optimization macro
      Update powerpc-fpu ULPs.
      PowerPC: Fix memchr ifunc hidden symbol for PPC32
      PowerPC: Remove unneeded copysign[f] macros
      PowerPC: Remove 64 bits instructions in PPC32 code
      PowerPC: Consolidate NPTL/non versions of vfork
      PowerPC: Consolidate NPTL/non versions of clone
      PowerPC: Move powerpc64 timer_*.c out of nptl/
      PowerPC: Move NPTL ABI headers to sysdeps.
      PowerPC: Move remaining nptl/sysdeps/unix/sysv/linux/powerpc/ files.
      Update powerpc-fpu ULPs.
      PowerPC: Fix optimized strncat strlen call
      Fix ChangeLog indentation.
      Update powerpc-fpu ULPs.
      Fix ChangeLog indentation.
      PowerPC: Move powerpc code out of nptl/ subdirectory
      PowerPC: sync hwcap.h capabilities
      Update powerpc-fpu ULPs.
      Update powerpc-fpu ULPs.
      PowerPC: Guard CALL_ELF check for ppc64 only in link.h
      PowerPC: memmove default implementation cleanup
      PowerPC: optimized memmove for POWER7/PPC64
      PowerPC: optimized memmove for POWER7/PPC32
      PowerPC: Align power7 memcpy using VSX to quadword
      PowerPC: Add ifunc tests for memmove
      PowerPC: Fix compiler warnings
      PowerPC: Cleanup powerpc memmove
      PowerPC: Fix build due missing lll_robust_trylock
      PowerPC: Fix gprof entry point for LE
      PowerPC: Fix termios definitions

Alan Modra (7):
      Fix s_copysign stack temp for PowerPC64 ELFv2
      Fix reference to toc symbol.
      Correct prefetch hint in power7 memrchr.
      Correct IBM long double nextafterl.
      Correct IBM long double frexpl.
      Update fixed bug list
      Correct DT_PPC64_NUM

Allan McRae (27):
      Open development for 2.20
      Fix qsort argument order in collation example
      Update Esperanto translations
      Fix variable used in sed expression in timezone/Makefile
      Update Swedish translations
      Mention CVE-2014-4043 in NEWS
      Add missing changelog entry for commit ab7ac0f2
      Add fixed bug to NEWS
      Update Spanish translations
      Regenerate libc.po
      Update Spanish translation
      Update Dutch translation
      Update Sweedish translation
      Update Bulgarian translation
      Update German translation
      Update Czech translation
      Update Polish translation
      Update Russian translation
      Update French translation
      Update Ukrainian translation
      Update Vietnamese translation
      Update x86 ULPs
      Update Catalan translation
      Update Esperanto translation
      Update Korean translation
      Update contrib.texi
      Update version.h and include/features.h for 2.20 release

Andi Kleen (5):
      Fix dwarf2 unwinding through futex functions.
      Add a fast path for C rd/wrlock v2
      Add adaptive elision to rwlocks
      Remove x86 assembler rwlock code
      Add fallback file for elide.h

Andreas Krebbel (3):
      BZ #16447: Fix ldbl-128 expl implementation.
      NEWS: Add 16447 to fixed bugs list.
      NEWS: Add comment about changed ABI on s390 and s390x.

Andreas Schwab (45):
      Move m68k from ports to libc
      Whitespace fixes
      Fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
      Properly fix memory leak in _nss_dns_gethostbyname4_r with big DNS answer
      Add GLIBC_2.17 to librt in Version.def
      Fix race conditions in pldd that may leave the process stopped after detaching
      nscd: also invalidate netgroup cache on reload
      Account for alloca use when collecting interface addresses (bug 16002)
      Fix use of half-initialized result in getaddrinfo when using nscd (bug 16743)
      Setup LOCPATH for tst-ftell-active-handler and tst-ftell-partial-wide in libio
      Fix use of uninitialized variable
      ChangeLog cleanup
      Correctly handle %p in wprintf (BZ #16890)
      Fix implicit declaration
      Don't use catomic functions in mcount (BZ #16912)
      Fix parsing of getai result from nscd for IPv6-only request
      Fix unbound stack use in NIS NSS module
      Fix typo in assertion
      Fix macro warning on HAVE_PT_CHOWN
      Remove last use of USE___THREAD
      Fix searching localedef input on I18NPATH (BZ #16984)
      Remove second argument from TLS_INIT_TP macro
      Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
      Install uz_UZ.UTF-8 locale (BZ #16095)
      ChangeLog fix
      m68k: avoid pointer to integer conversion warning
      m68k: Consolidate NPTL/non versions of vfork
      m68k: Consolidate NPTL/non versions of clone
      Update feature guard for strdup/strndup in <bits/string2.h>
      Pass $TIMEOUTFACTOR to tests also in cross testing
      Fix typo in preprocessor conditional
      m68k: update libm test ULPs
      Don't read past end of pattern in fnmatch (BZ #17062)
      Fix memory leak in regexp compiler (BZ #17069)
      Fix another memory leak in regexp compiler (BZ #17069)
      Don't ignore too long lines in nss_files (BZ #17079)
      Remove unused label
      m68k: Add compat symbols for scalbln*
      Update i386 libm test ULPs
      Fix missing newline in test output
      m68k: update libm test ULPs
      ChangeLog fix
      m68k: use generic lowlevellock.h
      Fix -Wundef warning for HAVE_IFUNC
      Fix missing <math_private.h> in ldbl-96 fma

Arjun Shankar (1):
      Correctly report nscd child process status (BZ #17092)

Aurelien Jarno (5):
      SPARC: add EFD_SEMAPHORE in <bits/eventfd.h> (BZ #16916)
      ptsname_r: don't leak uninitialized memory (BZ #16917)
      SPARC: add prlimit and prlimit64 in <bits/resource.h> (BZ #16943)
      fix nl_langinfo with static linking (BZ #16915)
      Fix strtold on 32-bit sparc (and probably others) (BZ #16965)

Bernard Ogden (3):
      hppa: Remove lowlevellock.c.
      MIPS - Remove mips lowlevellock.h.
      Check value of futex before updating in __lll_timedlock

Carlos O'Donell (27):
      BZ #16613: Support TLS in audit libraries.
      BZ #16632: Change [_BSD/_SVID]_SOURCE warning.
      Add a new "Inter-Process Communication" chapter.
      Use @Theglibc{} in manual/ipc.texi.
      Promote do_lookup_x:check_match to a full function.
      Add header and standard information to threads.texi.
      Revert 4248f0da6ff9e7dd63464cdecec2dec332dfc2f0.
      hppa: Regenerate ULPs.
      hppa: Regenerate ULPs again.
      hppa: Remove fma ulps from libm-test-ulps.
      hppa: Add _STACK_GROWS_* cases to pthread_attr_[sg]etstack.
      Fix ChangeLog formatting.
      manual/ipc.texi: Fix AC-safety notes.
      nscd: Make SELinux checks dynamic.
      Support _r_debug for static binaries.
      manual: Sort overview listing by manual order.
      hppa: Use r25 as second input to __longjmp.
      hppa: Use lll_futex_wake.
      hppa: Update lowlevellock.h.
      Relocate hppa from ports to libc.
      Remove ports README and update machine ChangeLogs.
      Final update to ports ChangeLog.
      Fix -Wundef warning for FEATURE_INDEX_1.
      Remove nested function mi_arena from malloc_info.
      hppa: Add ABI baselines.
      hppa: Remove GLIBC_2.3 from librt.abilist.
      NEWS: Typo fix: s/wil /will /g

Chris Metcalf (7):
      Move tilegx, tilepro, and linux-generic from ports to libc.
      tile: Fix cut-and-paste bug in commit fcccd5128.
      math: make test-fenv-preserve.c a no-op if FE_ALL_EXCEPT == 0.
      crypt: don't include ufc-crypt.h multiple times
      tile: move sysdeps/unix/sysv/linux/tile nptl files.
      tile: Consolidate NPTL/non versions of vfork
      [BZ #17354] tile: Fix up corner cases with signed relocations

David Holsgrove (2):
      [MicroBlaze]: Move MicroBlaze from ports to sysdeps.
      MicroBlaze: Add missing sysdep-cancel.h implementation

David S. Miller (17):
      Fix tst-sscanf and tst-swscanf on 64-bit.
      Regenerate sparc ULPs.
      Fix sigaction conform test failures on sparc.
      Fix some sparc conform test failures in siginfo.h
      Fix some sparc -Wundef build warnings.
      Correct sparc CPP guards for EMT_TAGOVF.
      Add round-mode context support to sparc.
      Fix v9/64-bit strcmp when string ends in multiple zero bytes.
      NEWS: Add 16885 to fixed bug list.
      Fix some termios.h conformtest failures on sparc.
      Fix excessive ULP for y1_upward (0x2p+0) in test-float and test-ifloat.
      Update Sparc ULPS.
      Fixup ChangeLog and add missing NEWS entry for previous commits.
      Consolidate sparc clone, fork, and vfork implementations.
      Update Sparc ULPs.
      Update sparc ULPS.
      Get rid of sparc specific NPTL internaltypes.h header.

David Svoboda (1):
      manual: clarify buffer behavior in getline [BZ #5666]

Dominik Vogt (1):
      S/390: Port of lock elision to System/z

Dylan Alex Simon (1):
      Update x86_64 libm-test-ulps on AMD family 21h model 1 (bug 16545).

Eric Wong (1):
      Avoid stat/fstat in statvfs/fstatvfs (BZ #15132)

Florian Weimer (12):
      misc/sys/select.h (__FD_MASK): Avoid signed integer overflow.
      Check for syscall error in the SETXID implementation in NPTL (bug 13347).
      Update NEWS for fixed bug 13347
      posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
      Fix tautological comparison in non-executed part of tst-setuid2 (BZ #17058)
      setlocale: Use the heap for the copy of the locale argument
      _nl_find_locale: Improve handling of crafted locale names [BZ #17137]
      manual: Update the locale documentation
      nptl: Fix abort in case of set*id failure [BZ #17135]
      __gconv_translit_find: Disable function [BZ #17187]
      Fix typo in CVE ID
      CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]

Guo Yixuan (2):
      Fixed pthread_spin_lock on sparc32/64 (bug 16882)
      New test for pthread_spin_lock (bug 16882)

H.J. Lu (8):
      Check AVX-512 assembler support first
      Replace __int128 with __int128_t in bits/link.h
      Use 3 bytes for __pad1 in pthread_rwlock_t for x32
      Remove sysdeps/x86_64/multiarch/rtld-strlen.S
      Add ifunc tests for x86_64 memset_chk and memset
      Enable AVX2 optimized memset only if -mavx2 works
      Replace cpuid asm statement with __cpuid_count
      Mention fixes for BZs 16194 and 16275 in NEWS

Ian Bolton (4):
      [AArch64] Provide initial implementation of math_private.h.
      [AArch64] Define HAVE_RM_CTX and related hooks.
      Add fenv test support for AArch64.
      [AArch64] Suppress unnecessary FPSR and FPCR writes.

Igor Zamyatin (3):
      Save and restore AVX-512 zmm registers to x86-64 ld.so
      Save/restore bound registers in _dl_runtime_resolve
      Save/restore bound registers for _dl_runtime_profile

Jeff Layton (1):
      fcntl-linux.h: add new definitions and manual updates for open file description locks

Jim Meyering (1):
      regex: don't deref NULL upon heap allocation failure

Joey Ye (1):
      Fix ARM NAN fraction bits.

Jose E. Marchesi (1):
      Fix sparc memcpy data corruption when using niagara2 optimized routines.

Joseph Anthony Pasquale Holsten (1):
      Fix typo in comment in res_query.c

Joseph Myers (158):
      Remove am33 port.
      Move shared sysdeps files from alpha to arm.
      Move arm from ports to libc.
      Fix whitespace in ARM files to allow move.
      Remove mips dependency on alpha.
      Move shared umount.c from hppa to mips.
      Move mips from ports to libc.
      Fix whitespace in MIPS files to allow move.
      Merge MIPS dl-lookup.c into generic file.
      Regenerate x86_64 ulps.
      Remove _BSD_SOURCE and _SVID_SOURCE.
      soft-fp: support after-rounding tininess detection.
      Make ABI tests generate .out files.
      Stop io/ftwtest deleting its own output.
      Remove indirection in stdio-common tests dependencies.
      Remove reference to subdir_lint.out.
      Combine __USE_BSD and __USE_SVID into __USE_MISC.
      Update MIPS math-tests.h for GCC 4.9 using soft-fp.
      Clean up trivially redundant __USE_MISC conditionals.
      Split up rules for tests that compare output with baselines.
      Split up rules for tests using mtrace and something else.
      Fix gen-auto-libm-tests sticky bit setting for negative results.
      Move tests of fma from libm-test.inc to auto-libm-test-in.
      Move tests of clog10 from libm-test.inc to auto-libm-test-in.
      Update ARM HWCAP data.
      Fix __ASSUME_ACCEPT4 issues (bug 16609).
      Fix __ASSUME_RECVMMSG issues (bug 16610).
      Fix __ASSUME_SENDMMSG issues (bug 16611).
      Complete _BSD_SOURCE / _SVID_source followup cleanup.
      Generate .test-result files for tests with special rules.
      Consistently include Makeconfig after defining subdir.
      Support expected failures in .test-result files.
      Fix libm-test.inc:print_complex_max_error handling of some error cases.
      Don't include individual test ulps in libm-test-ulps.
      Automatically check sanity of ulps from libm tests.
      Adjust how gen-auto-libm-tests handles before-rounding/after-rounding cases.
      Don't define __ASSUME_UTIMES for linux-generic architectures.
      Prepare libm-test.inc structures for multi-rounding-mode testing.
      Remove INSTALL_INFO setting in manual/Makefile.
      conformtest: correct set of standards for which some headers are tested.
      conformtest: correct set of standards for which more headers are tested.
      Enumerate tests with special rules in tests-special variable.
      conformtest: clean up POSIX expectations for semaphore.h, signal.h, tar.h.
      conformtest: split up running of tests from makefile.
      Generate overall summary of test results.
      Make tests consistently use *.out output files.
      Count miscellaneous files built on host for testing as tests.
      Include all of <time.h> from <sched.h> for older standards (bug 16670).
      Fix POSIX namespace for <bits/siginfo.h> (bug 16674).
      Add libm-test.inc macro for all-rounding-modes testing.
      Fix nextafter overflow in non-default rounding modes (bug 16677).
      Fix MIPS libc_feresetround*_ctx to preserve exceptions.
      Fix __ASSUME_PSELECT for MicroBlaze (bug 16642).
      Regenerate INSTALL.
      Do not terminate default test runs on test failure.
      Add libm-test support for per-rounding-mode manually specified results.
      Test rint and nearbyint with same inputs, in all rounding modes.
      Exit with error status on check-abi failure.
      Test scalbn and scalbln in all rounding modes, add more tests of negative arguments.
      Fix __ASSUME_PREADV and __ASSUME_PWRITEV for Alpha and MicroBlaze (bug 16649).
      Use ALL_RM_TEST for more libm tests.
      Make libm-test support ALL_RM_TEST with AUTO_TESTS_*.
      Test most libm functions in all rounding modes.
      Fix log (1) in round-downward mode (bug 16731).
      Fix -Wundef warnings for _ABI* on MIPS.
      Fix dbl-64 exp overflow/underflow in non-default rounding modes (bug 16284).
      Fix implicit __isinf declarations in exp.
      Relax gen-auto-libm-tests may-underflow rules, test log1p in all rounding modes.
      Add empty GLIBC_2.2.5 version to elf/Versions.
      Make x86_64 fegetenv preserve exception mask (bug 16198).
      Fix x86/x86_64 expl/exp10l spurious underflows (bug 16348).
      Fix clog10 (-0 +/- 0i) (bug 16362).
      Fix scalb spurious "invalid" exceptions (bug 16770).
      Fix futimesat for older MicroBlaze kernels (bug 16648).
      Correct robust mutex / PI futex kernel assumptions (bug 9894).
      Set errno for atan2 underflow (bug 16349).
      Set errno for scalb errors (bug 6803, bug 6804).
      Fix clog / clog10 sign of zero result in round-downward mode (bug 16789).
      Fix catan, catanh, __ieee754_logf in round-downward mode (bug 16799, bug 16800).
      conformtest: clean up POSIX expectations for stdlib.h, string.h.
      Increase minimum Linux kernel version to 2.6.32.
      Include SSE state in i386 fenv_t (bug 16064).
      Clean up kernel version conditionals for pre-2.6.32 kernels.
      Clean up ARM old-ABI symbol versioning relics.
      Reduce kernel-features.h duplication.
      Fix erf underflow handling near 0 (bug 16516).
      Fix acosh (1) in round-downward mode (bug 16927).
      Fix cacos (+Inf + finite*i) in round-downward mode (bug 16928).
      Fix log1pl (LDBL_MAX) in FE_UPWARD mode (bug 16564).
      Use existing makefile variables for dependencies on glibc libraries.
      Fix ARM build with GCC trunk.
      Consistently use $(elf-objpfx).
      Don't mention linuxthreads in Depend files.
      Fix log10 (1) in round-downward mode (bug 16977).
      Define TSVTX in tar.h for older POSIX (bug 16978).
      Include LOCPATH in default test environment.
      Don't require test wrappers to preserve environment variables, use more consistent environment.
      Remove redundant C locale settings.
      conformtest: clean up POSIX expectations for termios.h, time.h.
      Remove special makefile rules / .sh files for some localedata tests.
      Fix log2 (1) in round-downward mode (bug 17042).
      conformtest: clean up POSIX expectations for sys/mman.h, sys/stat.h, sys/types.h.
      Add CFI to x86 ceil / floor / trunc (bug 16681).
      Use $(rtld-prefix) more consistently.
      Fix __ieee754_logl (-LDBL_MAX) in FE_DOWNWARD mode (bug 17022).
      Remove __ASSUME_ATFCTS conditionals in sysdeps/unix/sysv/linux/.
      Remove __ASSUME_ADJ_OFFSET_SS_READ.
      Remove __ASSUME_AT_RANDOM.
      Remove __ASSUME_F_GETOWN_EX.
      Remove __ASSUME_SOCK_CLOEXEC / SOCK_CLOEXEC conditionals in Linux-specific code.
      Include <kernel-features.h> explicitly where required.
      Remove ARM __ASSUME_SIGFRAME_V2.
      Update headers for Linux 3.15.
      Fix pow overflow in non-default rounding modes (bug 16315).
      Test cpow in all rounding modes.
      Set errno for y1 overflow (bug 17050).
      Fix cosh spurious underflows from expm1 (bug 16354), inaccurate results near 0 (bug 17061).
      Move architecture cases out of sysdeps/unix/sysv/linux/configure.ac.
      Fix ldbl-128 erfl spurious underflows (bug 16287).
      Fix x86/x86_64 expm1l spurious underflow exceptions (bug 16539).
      Remove __ASSUME_COMPLETE_READV_WRITEV.
      Fix exp10 spurious underflows (bug 16560).
      Remove __ASSUME_UTIMENSAT.
      Update README and NEWS for ports directory removal.
      Remove __ASSUME_XFS_RESTRICTED_CHOWN.
      Update timezone code from tzcode 2014e.
      Move base_machine and machine settings from configure.ac to sysdeps preconfigure fragments.
      Remove BROKEN_PPC_ASM_CR0 configure test.
      Remove stray includes of kernel-features.h.
      Move USE_REGPARMS define to sysdeps/i386/configure.ac.
      Remove __ASSUME_O_CLOEXEC / O_CLOEXEC conditionals in sysdeps/unix/sysv/linux/.
      Remove configure tests for assembler CFI support.
      Remove powerpc special cases in configure.ac.
      Update miscellaneous files from upstream sources.
      Update scripts/list-sources.sh for ports repository merge.
      Fix MIPS64 *_nocancel gp setup.
      Fix yn overflow handling in non-default rounding modes (bug 16561, bug 16562).
      Remove relro configure test.
      Remove shlib-versions ABI names support.
      Fix ldbl-128 powl sign of result in overflow / underflow cases (bug 17097).
      Rename soft-fp extended.h, op-common.h variables to avoid risk of shadowing.
      Rename soft-fp op-[1248].h variables to avoid risk of shadowing.
      Fix ldbl-128 expm1l spurious underflow (bug 16539).
      Regenerate ARM libm-test-ulps.
      Regenerate powerpc-nofpu libm-test-ulps.
      Regenerate MIPS libm-test-ulps.
      MicroBlaze: Update kernel-features.h for syscalls added in 3.15
      Move architecture shlib-versions files to Linux-specific directories.
      Refactor handling of /lib64 etc. cases, move out of sysdeps/gnu/configure.ac.
      Split x86_64 out of main Linux kernel-features.h.
      Split i386 out of main Linux kernel-features.h.
      Split sparc out of main Linux kernel-features.h.
      Split powerpc out of main Linux kernel-features.h.
      Split sh out of main Linux kernel-features.h.
      Split s390 out of main Linux kernel-features.h.
      Fix fallback fesetenv and feupdateenv on FE_NOMASK_ENV (bug 17088).
      Fix powerpc-nofpu __fe_enabled_env and __fe_nonieee_env (bug 17261).
      Fix powerpc32 __get_clockfreq for non-power4 (bug 17263).

Julian Brown (1):
      ARM: Fix R_ARM_IRELATIVE RELA relocations.

Khem Raj (1):
      Define __GI_fegetenv for e500 libm

Konstantin Serebryany (2):
      Remove nested functions: crypt/md5-crypt.c
      Remove redundant nested function b64_from_24bit

Kyle McMartin (1):
      [AARCH64] correct alignment of TLS_TCB_ALIGN (BZ #16796)

Ling Ma (2):
      Add x86_64 memset optimized for AVX2
      Improve 64bit memcpy performance for Haswell CPU with AVX instruction

Ludovic Courtès (1):
      nscd: Remove unused typedef and variable.

Maciej W. Rozycki (8):
      ARM: soft-fp NaN representation correction
      [BZ #17075] ARM: Fix immediate calculation of R_ARM_TLS_DESC
      stdlib/tst-qsort2.c: Fix off-by-one argc interpretation error
      [BZ #16046] dl_iterate_phdr static executable test
      sysdeps/unix/sysv/linux/bits/socket.h: Correct formatting
      test-skeleton: Kill any child process's offspring
      stdlib/tst-strtod-overflow: Bump timeout up yet
      [BZ #17078] ARM: R_ARM_TLS_DESC prelinker support

Marcus Shawcroft (7):
      Relocate AArch64 from ports to libc.
      [AArch64] Optional trapping exceptions support.
      [AArch64] Regenerate libm-test-ulps.
      Revert "ARM: Improve fenv implementation"
      [AArch64] Regenerate libm-test-ulps
      Revert "Add bug 16918 to NEWS."
      Revert "aarch64: Add hp-timing.h"

Mark Wielaard (1):
      i386 TLS_INIT_TP might produce bogus asm changing stack pointer [BZ #17319]

Marko Myllynen (1):
      Replace __int128 with __int128_t

Meador Inge (1):
      get_nprocs: Only return explictly set cache values (BZ #16996)

Mike Frysinger (23):
      linux_fsinfo.h: sync with current linux/magic.h
      tzselect: stop requiring ksh
      linux: bits/in.h: sync with latest kernel headers
      linux: bits/in.h: sync with latest kernel headers
      tst-longjmp_chk: add comments and convert to test-skeleton
      tests: unify fortification handler logic
      tst-longjmp_chk3: new test for checking sigaltstack edge cases
      tst-backtrace4: expand output even on failures
      manual: setjmp: fix typos/grammar
      sem_open: allow RAMFS_MAGIC for mount points
      shm_open: sync with logic in sem_open
      ia64: relocate out of ports/ subdir
      tst-longjmp_chk2: add comments/sanity check
      manual: time: fix typo in IST example
      sotruss: drop ksh support and add basic POSIX shell support
      delete ksh checks
      stop supporting bash-1.x
      tst-setcontext: fix style
      add ChangeLog for previous commit
      ia64: define nocancel entry points in PSEUDO
      add ChangeLog for previous commit
      tst-gettext2: make setup more robust
      detect broken linker handling of __ehdr_start

Ondřej Bílka (20):
      Remove THREAD_STATS.
      Deduplicate setenv.
      Fix previous commit.
      Use glibc_likely instead __builtin_expect.
      Remove unused variable from stdlib/setenv.c
      Deduplicate resolv/nss_dns/dns-host.c
      Simplify calloc implementation.
      Fix two spaces after sentence.
      Make strtok benchmark competive.
      Add changelog.
      Fix recvmmsg comment.
      Fix types of stream hook functions in manual.
      Fix typo in nptl/sockperf.c
      Fix typo in nscd/selinux.c
      fix changelog.
      Remove duplicate code in elf/dl-deps.c.
      revert commit fdfd175d46ac6a810ebdeb2a2936e6d7d13995ab
      Remove mi_arena nested function.
      Fix typo in manual.
      Fix memory overrun in getifaddrs_internal. Fixes bug 15698.

Paul Eggert (2):
      Sync up mktime with gnulib
      misc/sys/cdefs.h: Add _Noreturn macro for pre-C11 compilers

Paul Pluzhnikov (8):
      2014-03-12  Paul Pluzhnikov  <ppluzhnikov@google.com>
      Add missing elf/tst-pie2.c -- should have been in
      Fix BZ #16634.
      Address post-commit patch comments.
      2014-03-26  Paul Pluzhnikov  <ppluzhnikov@google.com>
      2014-03-27  Paul Pluzhnikov  <ppluzhnikov@google.com>
      2014-04-11  Paul Pluzhnikov  <ppluzhnikov@google.com>
      Fix typo on ChangeLog.

Peter TB Brett (1):
      Use statvfs64() for pathconf(_PC_NAME_MAX).

Rajalakshmi Srinivasaraghavan (3):
      print length in strrchr benchtest
      PowerPC: strrchr optimization for POWER7/PPC64
      PowerPC: Fix nearbyintl failure for few inputs

Rasmus Villemoes (1):
      manual: Update prototypes for alphasort and friends

Richard Earnshaw (1):
      [AArch64] Add optimized strchr.

Richard Henderson (55):
      Relocate alpha from ports to libc
      alpha: Regenerate sysdeps/alpha/libm-test-ulps
      alpha: Fix __pointer_chk_guard definition for the testsuite
      alpha: Enable unwind tables for backtrace.c
      alpha: Remove alpha-linux pthread_once.c
      Merge remote-tracking branch 'origin/roland/nptl-alpha'
      alpha: Create __syscall_nocancel entry points
      alpha: Define ELF_MACHINE_NO_RELA
      alpha: Remove bits/siginfo.h (BZ 16966)
      alpha: fix sa_flags type (BZ 16967)
      aarch64: Merge rtld_errno offset with memory reference
      aarch64: Merge __local_multiple_threads offset with memory reference
      alpha: Remove nptl/fork.c
      alpha: Merge standard and nptl clone.S
      alpha: Consolidate NPTL/non versions of vfork
      alpha: Move remaining files out of sysdeps/unix/sysv/linux/alpha/nptl/
      Only support ifunc in nptl/pt-vfork.c
      Only provide non-default symbols in libpthread for vfork
      alpha: Do non-default symbols in pt-vfork.S
      aarch64: Fix DO_CALL block comment
      aarch64: Remove DOARGS/UNDOARGS macros
      aarch64: Tidy syscall error check
      arm,aarch64: Remove SINGLE_THREAD_P_PIC
      aarch64: Tabify sysdep-cancel.h
      aarch64: Share code in syscall-cancel.h
      aarch64: Pass regno parameter to SINGLE_THREAD_P
      aarch64: Improve syscall-cancel stack frame
      aarch64: Use tpidr_el0 rather than __read_tp in librt
      aarch64: Use tpidr_el0 rather than __errno_location in librt
      aarch64: Rely on syscalls preserving registers
      aarch64: Fix error return from __ioctl
      aarch64: Remove PSEUDO_RET
      aarch64: Consolidate NPTL/non versions of clone
      aarch64: Consolidate NPTL/non versions of vfork
      aarch64: Remove nptl/vfork.S
      alpha: Update libm-test-ulps
      alpha: Fix isnan
      powerpc: Remove dummy hp-timing.h
      Removing HP_TIMING_ZERO as unused
      Removing HP_TIMING_ACCUM as unused
      Remove HP_TIMING_DIFF_INIT and dl_hp_timing_overhead
      Unify hp-timing implementations
      aarch64: Add hp-timing.h
      Always provide HP_SMALL_TIMING_AVAIL
      Rely on HP_TIMING_AVAIL implies HP_SMALL_TIMING_AVAIL
      Changelog for last 8 patches
      alpha: Remove round and roundf implementations
      alpha: Fix lround implementations
      alpha: Implement math_opt_barrier and math_force_eval
      alpha: Remove nearbyint and nearbyintf implementations
      aarch64: Update libm-test-ulps
      Force eval for fma implementations
      alpha: Remove linux lowlevellock.h
      alpha: Remove linux lowlevellock.h
      alpha: Fix exception raising from soft-fp

Roland McGrath (150):
      Avoid comma operator warnings.
      Remove unused %include lines from Versions files.
      Remove obsolete SHLIB_COMPAT conditionalization in Versions files.
      Add missing } in Versions file.
      Fix fallout from Joseph's untested Makeconfig change.
      Retire the separate ChangeLog files in nptl/ and nptl_db/ subdirs.
      ARM: Fix up setjmp/longjmp changes sfi_* macro use.
      ChangeLog format fix.
      Use __ehdr_start, when available, for rtld to get its own headers.
      Fix two stray cases using #ifdef vs #if for TLS_TCB_AT_TP.
      Compile with -Wundef.
      Get rid of Versions.def source file
      Remove "Compiled on ..." crapola from version text.
      Work around binutils bugs in 2.23 and older
      Move bits/mman-linux.h out of sysdeps/unix/sysv/linux/.
      Add comments about non-Linux use of bits/mman-linux.h.
      Kludge fix for Versions.def regression
      Factor mmap/munmap of PT_LOAD segments out of _dl_map_object_from_fd et al.
      Add deprecation header text to remaining ports/ChangeLog* files.
      Move ports/ChangeLog* files to ChangeLog.old-ports*, remove ports/ directory.
      Deconditionalize use of LLL_LOCK_INITIALIZER in bits/libc-lock.h.
      Fix -Wundef warnings for _IO_JUMPS_OFFSET.
      Fix -Wundef issues in generated errlist.c.
      Move rules for Linux-specific pldd program to Linux-specific Makefile.
      Move ARM internal unwind.h header to the right sysdeps directory.
      Fix -Wundef for _UTSNAME_DOMAIN_LENGTH.
      Some configure-related decrufting.
      Silence a missing-noreturn warning for _Unwind_Resume.
      Make armv7 strcmp assembly compatible with ARM mode and SFI.
      Clean up __exit_thread.
      Consolidate NPTL vs non clone.S for ARM.
      Consolidate NPTL configury for ARM/Linux.
      Verbatim NPTL file moves for ARM/Linux.
      Move NPTL public ABI headers for ARM to sysdeps/arm/nptl/.
      ARM: Consolidate NPTL/non versions of vfork
      x86: Consolidate NPTL/non versions of vfork
      Move NPTL public ABI headers for x86 to sysdeps/x86/nptl/.
      x86: Consolidate NPTL/non versions of clone
      Move x86_64 timer_*.c out of nptl/
      Move x86_64 compat-timer.h out of nptl/
      x86_64: Remove useless pthread_spin_{init,unlock} wrapper files.
      Update s390 timer_*.c files for x86_64 file moves.
      Consolidate not-cancel.h files.
      x86: Consolidate NPTL fork.
      Move remaining nptl/sysdeps/unix/sysv/linux/x86_64/ files.
      i386: Remove useless pthread_spin_{init,unlock} wrapper files.
      Update alpha and ia64 timer_*.c files for x86_64 file moves.
      Fix powerpc fork after i386 reorganization.
      Move remaining nptl/sysdeps/unix/sysv/linux/i386/ files.
      Fix mips fork after i386 reorganization.
      Move remaining files out of nptl/sysdeps/unix/sysv/linux/x86/.
      x86: Move abilist files out of nptl/ subdirectories.
      Split arch-fork.h from fork.h
      Add stub arch-fork.h header.
      ARM: Convert fork.c to arch-fork.h
      Alpha: Convert fork.c to arch-fork.h
      Fix __waitpid_nocancel link error.
      AArch64: Convert fork.c to arch-fork.h
      SH: Convert fork.c to arch-fork.h
      IA64: Convert fork.c to arch-fork.h
      tile: Convert fork.c to arch-fork.h
      SH: Consolidate NPTL/non versions of clone
      m68k: Convert fork.c to arch-fork.h
      SH: Consolidate NPTL/non versions of vfork
      Move NPTL public ABI headers for SH to sysdeps/sh/nptl/.
      Start cleaning up TLS initial value for pthread_create.
      ARM: Define TLS_DEFINE_INIT_TP
      MIPS: Define TLS_DEFINE_INIT_TP
      HPPA: Define TLS_DEFINE_INIT_TP
      m68k: Define TLS_DEFINE_INIT_TP
      SH: Define TLS_DEFINE_INIT_TP
      AArch64: Define TLS_DEFINE_INIT_TP
      PowerPC: Define TLS_DEFINE_INIT_TP
      Alpha: Define TLS_DEFINE_INIT_TP
      S390: Define TLS_DEFINE_INIT_TP
      Tile: Define TLS_DEFINE_INIT_TP
      Move x86_64 code out of nptl/ subdirectory.
      Move SH code out of nptl/ subdirectory.
      Move i386 code out of nptl/ subdirectory.
      Consolidate NPTL sigprocmask.
      Get rid of nptl/sysdeps/pthread/ subdirectory
      Use list.h in posix-timer code.
      SPARC: Convert fork.c to arch-fork.h
      SPARC: Define TLS_DEFINE_INIT_TP
      Move SPARC code out of nptl/sysdeps/sparc/.
      Move SPARC public headers out of nptl/
      S390: Convert fork.c to arch-fork.h
      Move S390 code out of nptl/sysdeps/s390/.
      S390: Move NPTL public headers to sysdeps/s390/nptl/.
      Move remaining SPARC code out of nptl/.
      Missing new file from last commit.
      Move linux bits/ files out of nptl/.
      Clean up stack-coloring macros.
      Clean up HAVE_CONFIG_H and STDC_HEADERS.
      Remove unused file rtld-lowlevel.h.
      Move generic smp.h to nptl/
      SH: Consolidate nptl/ subdirectories under linux/.....
      m68k: Consolidate nptl/ subdirectories under linux/...
      MIPS: Move NPTL public headers to sysdeps/mips/nptl/.
      powerpc: Consolidate nptl/ subdirectories under linux/....
      Remove an unused variable in fstatvfs.
      Add missing #include in get-rounding-mode.h
      x86: Consolidate unnecessary nptl/ subdirectories.
      SPARC: Consolidate nptl/ subdirectories under linux/...
      SPARC: Consolidate unnecessary nptl/ subdirectories.
      MIPS: Consolidate NPTL/non versions of clone
      AArch64: Consolidate nptl/ subdirectories under linux/...
      S390: Consolidate NPTL/non versions of clone
      S390: Consolidate NPTL/non versions of vfork
      Move remaining S390 code out of nptl/.
      S390: Consolidate nptl/ subdirectories under linux/...
      Add missing #include in spawn_faction_addopen.c
      Add missing #include <fpu_control.h> to ARM fesetenv/feupdateenv.
      ARM: Move more aeabi routine magic out of Linux-specific directories
      MIPS: Consolidate NPTL/non versions of vfork
      MIPS: Consolidate nptl/ subdirectories under linux/...
      ARM: Split Linuxism out of sysdeps/arm/nptl/tls.h
      MicroBlaze: Convert fork.c to arch-fork.h
      MicroBlaze: Define TLS_DEFINE_INIT_TP
      MicroBlaze: Move NPTL public headers to sysdeps/microblaze/nptl/.
      MicroBlaze: Consolidate NPTL/non versions of vfork
      MicroBlaze: Consolidate nptl/ subdirectories under linux/...
      Add missing #include for MIN/MAX users.
      Add missing #include for MIN use in dl-sysdep.c.
      S390: Quash unused variable warning due to no-op THREAD_SET_POINTER_GUARD.
      Robustify Linux kernel headers configure checks
      Add missing #include in sysdeps/alpha/fpu/s_nearbyint.c
      Fix unwind.h configure check for bare environment.
      Fix ia64 build error in lll_futex_timed_wait_bitset
      Get rid of nptl/sysdeps/ entirely!
      NPTL is no longer an add-on!
      Remove old stub lowlevellock.h file.  It is not even useful as documentation.
      Get rid of lll_robust_trylock.
      Get rid of lll_robust_dead.
      ChangeLog fixup for last commit.
      Remove declarations of two nonexistent variables from nptl/pthreadP.h.
      Separate Linuxisms from lowlevellock.h, make a generic one
      Add generic/stub implementations of pthread_{kill,sigmask,sigqueue}.
      ARM: Clean up EABI-related configury
      Split nptl-signals.h out from pthreadP.h
      Use __builtin_trap for ABORT_INSTRUCTION.
      Add __safe_fatal and use it in __pthread_unwind forwarder fallback.
      ARM: Move PTR_MANGLE et al out of Linux-specific file.
      Remove sysdeps/unix/sysv/linux/arm/lowlevellock.h
      IA64: Consolidate NPTL/non versions of clone
      IA64: Consolidate NPTL/non versions of vfork
      IA64: Define TLS_DEFINE_INIT_TP
      IA64: Move NPTL public headers to sysdeps/ia64/nptl/.
      IA64: Consolidate nptl/ subdirectories under linux/...
      NEWS: Mention x86-64 ld.so use of Intel MPX instructions.

Sami Kerola (1):
      tzselect: use zonedir instead of current working directory

Samuel Thibault (5):
      hurd: Do not allow unmapping address 0
      hurd: Move dtv, dtv_t, tcbhead_t declaration to per-arch file.
      hurd: Add i386 fields to TLS structure
      Simplify atomicity of socket creation in bind.
      Fix hang on fork

Sean Anderson (1):
      malloc: fix comment typo

Serge Hallyn (1):
      misc/sys/xattr.h: guard against linux uapi header inclusion

Siddhesh Poyarekar (85):
      Minor formatting fix
      Fix sign of input to bsloww1 (BZ #16623)
      Fix ChangeLog formatting
      Fix missing ChangeLog
      nscd: Improved support for tracking startup failure in nscd service (BZ #16639)
      Separate ftell from fseek logic and avoid modifying FILE data (#16532)
      Use cached offset in ftell when reliable
      Fix up formatting
      Fix up formatting in tst-ftell-active-handler.c
      Mark nscd service as forking in systemd service file (BZ #16639)
      Provide correct buffer length to netgroup queries in nscd (BZ #16695)
      Get rid of __LT_SPINLOCK_INIT
      Fix up return codes for tests in tst-ftell-active-handler
      Fix offset caching for streams and use it for ftell (BZ #16680)
      Change offset in fdopen only if setting O_APPEND
      Fix -Wundef warnins for __FP_FAST_FMA*
      Implement benchmarking script in python
      ChangeLog formatting fix
      benchtests: Move bench.py to benchtests/scripts/
      Fix nscd lookup for innetgr when netgroup has wildcards (BZ #16758)
      Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760)
      Return NULL for wildcard values in getnetgrent from nscd (BZ #16759)
      [benchtests] Use inputs file for modf
      Make bench.out in json format
      Detailed benchmark outputs for functions
      benchtests: Link against objects in build directory
      Include atomic.h in sem_wait.c and sem_trywait.c
      Use test-skeleton.c in tst-sem3 and tst-sem4
      Do not fail if one of the two responses to AF_UNSPEC fails (BZ #14308)
      Consolidate code to initialize nscd dataset header
      Initialize all of datahead structure in nscd (BZ #16791)
      Return EAI_AGAIN for AF_UNSPEC when herrno is TRY_AGAIN (BZ #16849)
      Fix formatting
      Fix date in ChangeLog
      Use NSS_STATUS_TRYAGAIN to indicate insufficient buffer (BZ #16878)
      benchtests: Add new directive for benchmark initialization hook
      Fix offset computation for append+ mode on switching from read (BZ #16724)
      Add mmap usage in malloc_info output
      Fix formatting in malloc_info
      Fix format specifier for n_mmaps
      Inline nested function check_list
      Validate bench.out against a JSON schema
      Remove unnecessary $(.)
      Fix ChangeLog and NEWS goof-up
      Print offending diff when check-abi fails
      Fix build warning in pthread_rwlock_*
      Fix namespace violation in pthreadtypes.h (BZ #17084)
      Add compat symbols for scalb* in i386
      Fix Wundef warning for SEPARATE_KEY
      Fix Wundef warning for ELF_MACHINE_NO_RELA
      Fix Wundef warning for WIDE_CHAR_VERSION
      Remove inline keyword from leapyear function
      Remove unnecessary include in memmove_chk
      Correctly attribute the mktime.c change to Paul Eggert
      Fix Wundef warning for MEMCPY_OK_FOR_FWD_MEMMOVE
      Remove MULTI_PTRS_ARE_ALIASES in dns-hosts.c
      Add comment to gethnamaddr.c to warn that the file is unmaintained
      Fix typo in macro name
      Fix typo and formatting in loadmsgcat.c
      Fix -Wundef warning on PAGE_COPY_THRESHOLD
      Don't use __glibc_unlikely in shared code
      Fix Wundef warning for __STDC_VERSION__
      Sync up loadmsgcat.c with gettext
      Restore subdir conditional for tst-timer dependency.
      Add comment for MEMCPY_OK_FOR_FWD_MEMMOVE
      Fix Wundef warning with SHOJI_IS_RIGHT
      Fix Wundef warning for ELF_MACHINE_NO_REL on i386
      Check value at resplen2 if it is not NULL
      Fix Wundef warning for __cplusplus
      Fix -Wmaybe-uninitialized warning in xdr.c
      Add comment about SIZE initialization in xdr.c
      Fix crash when system has no ipv6 address [BZ #17125]
      Fix -Wundef warning for HAVE_OBSTACK
      Fix -Wundef warning for HAVE_SYS_PARAM_H
      Fix Wundef warning for HAVE_STRFTIME
      Fix -Wundef warning for HAVE_LOCALTIME_R
      Sync up error.c with gnulib
      Fix -Wundef warnings in fnmatch.c
      Check if DEBUG is defined in regex_internal.c
      Fix -Wundef warnings in regex_internal.h
      Disable x87 inline functions for x86_64 and SSE [BZ #17262]
      Fix comment error that Jakub pointed out but I forgot to fix
      Remove unnecessary uses of NOT_IN_libc
      Remove redundant CPPFLAGS for some programs
      Remove NOT_IN_libc definition for pthread_atfork

Sihai Yao (1):
      Detect if AVX2 is usable

Stefan Liebler (24):
      S/390: Regenerate ULPs.
      S390: Fix -Wundef warning for __PTHREAD_MUTEX_HAVE_ELISION.
      Use += before-compile instead of a :=.
      S390: Correct type of sa_flags in struct sigaction for POSIX conformance
      S390: Define SIZE_MAX as unsigned long (BZ #16712).
      S390: Fix namespace violation in struct stat (BZ #16714).
      NEWS: Add 16712, 16713, 16714 to fixed bug list.
      S/390: Unify 31 and 64 bit configure.ac
      [BZ #16824] Fix failing y1 due to too large ulps in downward/upward rounding mode.
      [BZ #14770] S/390: Require Binutils >= 2.24 for target S/390.
      S/390: Regenerate ULPs
      [BZ #16823] Fix log1pl returning wrong infinity sign
      Mention BZ16823 in NEWS
      Fix typo in tst-mutex5 ifndef -> ifdef
      Disable lock elision for PTHREAD_MUTEX_NORMAL.
      S/390: Regenerate ULPs.
      posix_spawn_faction_addopen: Add missing string.h include directive
      Fix pthread.h in installed-headers list.
      Generate en_GB.UTF-8 during testing
      [BZ #6803] Set errno for scalbln, scalbn
      S/390: Regenerate ULPs
      S/390: Revert the jmp_buf/ucontext_t ABI change.
      S390: Fix remaining ONE_DIRECTION warning messages
      NEWS: Explain the s390 jmp_buf / ucontext_t ABI change reversal.

Steve Ellcey (7):
      Add macros and inline functions to mips math_private.h file.
      2014-04-29  Steve Ellcey  <sellcey@mips.com>
      2014-05-01  Steve Ellcey  <sellcey@mips.com>
      2014-05-01  Steve Ellcey  <sellcey@mips.com>
      2014-05-01  Steve Ellcey  <sellcey@mips.com>
      2014-05-07  Steve Ellcey  <sellcey@mips.com>
      Add 16922 to list of bugs fixed.

Tomas Dohnalek (1):
      Generate .test-result files for ordinary tests.

Torvald Riegel (2):
      benchtests: Add pthread_once common-case test.
      Fixed and unified pthread_once.

Venkataramanan Kumar (1):
      aarch64: Add setjmp and longjmp SystemTap probes

Vidya Ranganathan (4):
      PowerPC: strspn optimization for PPC64/POWER7
      PowerPC: strncpy/stpncpy optimization for PPC64/POWER7
      PowerPC: Optimized strcmp for PPC64/POWER7
      PowerPC: strcat optimization for PPC64/POWER7

Wilco (18):
      Add fenv test support for targets which don't have FP traps.
      ARM: Improve fenv implementation
      ARM: Improve fenv implementation
      [AArch64] Rewrite feupdateenv (BZ 17009).
      [AArch64] Remove ISB after FPCR write.
      [AArch64] Cleanup declarations in math_private.h.
      [AArch64] Switch from FE_TOWARDZERO to _FPU_FPCR_RM_MASK
      Add FE_NOMASK_ENV return value test.
      Use libc calls defined by fenv_private.h to implement several fenv functions
      Speed up the ARM fenv implementation by avoiding unnecessary FPSCR
      Rewrite feupdateenv
      Add bug 16918 to NEWS.
      Cleanup fenv implementation
      Remove an unused include.
      Add _FPU_MASK_RM and use it instead of FE_TOWARDZERO.
      Optimize fesetenv
      Add bug 16918 to NEWS.
      Fix performance issue in misaligned strcpy.

Wilco Dijkstra (3):
      [ARM] Add support for fenv_private on ARM.
      Add generic HAVE_RM_CTX implementation
      This patch adds new function libc_feholdsetround_noex_aarch64_ctx, enabling

Will Newton (49):
      malloc/mtrace.c: Cosmetic cleanup.
      include/stap-probe.h: Add comment about SystemTap argument format
      manual/probes.texi: Add documentation of setjmp/longjmp probes
      manual/probes.texi: Use "triggered" instead of "hit"
      ARM: Add SystemTap probes to longjmp and setjmp.
      manual/setjmp.texi: Improve clarity of Sys V context doc
      Fix __PTHREAD_MUTEX_HAVE_ELISION -Wundef warning
      Fix HP_SMALL_TIMING_AVAIL -Wundef warnings
      Fix _IO_JUMPS_OFFSET -Wundef warnings
      Fix __STRICT_ANSI__ -Wundef warnings
      Fix HAVE_RM_CTX -Wundef warnings
      Revert "Fix HAVE_RM_CTX -Wundef warnings"
      Revert "Fix _IO_JUMPS_OFFSET -Wundef warnings"
      Revert "Fix HP_SMALL_TIMING_AVAIL -Wundef warnings"
      Revert "Fix __PTHREAD_MUTEX_HAVE_ELISION -Wundef warning"
      aarch64: Remove inaccurate comment from sysdep.h
      benchtests/bench-strtod.c: Increase timeout value
      benchtests: Add benchtests for ffs and ffsll
      benchtests: Build ffs and ffsl benchtests with -fno-builtin
      elf/dl-lookup.c: Remove obsolete comment about nested function
      string: Cosmetic cleanup of string functions
      malloc: Fix MALLOC_DEBUG -Wundef warning
      benchtests: Improve readability of JSON output
      aarch64: Re-implement setcontext without rt_sigreturn syscall
      stdlib/tst-setcontext.c: Check for clobbering of signal stack
      manual/setjmp.texi: Clarify setcontext and signal handlers text
      ARM: Remove lowlevellock.c
      NEWS: Add 15119 to fixed bug list
      ARM: Add optimized ARMv7 strcmp implementation
      ARM: Allow auto-detection of linker relro feature
      malloc: Add mallopt test.
      stdlib/gmp-impl.h: Silence -Wundef warning for USE_STACK_ALLOC
      AArch64: Fix handling of nocancel syscall failures
      ARM: Fix handling of concurrent TLS descriptor resolution
      malloc/malloc.c: Avoid calling sbrk unnecessarily with zero
      test-skeleton.c: Use stdout for error messages
      elf/dl-lookup.c: Move STB_GNU_UNIQUE handling to a function
      elf/dl-lookup.c: Remove unnecessary static variable
      elf/dl-lookup.c: Use __glibc_likely and __glibc_unlikely
      sysdeps/posix/tempname.c: Merge from gnulib
      ARM: Add support for AT_HWCAP2 in _dl_procinfo
      malloc/obstack: Merge from gnulib
      ARM: Define ELF_MACHINE_NO_REL
      string/memchr.c: Merge from gnulib
      Fix -Wundef warnings for SHARED
      iconv/loop.c: Fix -Wundef warning with !_STRING_ARCH_unaligned
      ARM: Fix compiler warnings from atomic.h
      AArch64: Remove lowlevellock.h
      Add BZ #16892 to NEWS

Yang Yingliang (1):
      Fix lll_unlock twice in pthread_cond_broadcast

Yufeng Zhang (1):
      [AArch64] Use GCC builtins to count leading/tailing zeros.

Yury Gribov (1):
      Update ARM ulps for VFPv4 (bug 16600).

Yvan Roux (1):
      AArch64: Remove asm/ptrace.h inclusion in sys/user.h and sys/procfs.h

-----------------------------------------------------------------------
Comment 13 David Nilsson 2015-01-08 14:21:11 UTC
I'm unable to reproduce the correct behaviour using a local build of f9d2d0325, glibc-2.20 and current HEAD.

This is evaluated using the supplied test case (bug.c) which still prints DNS 
data being received on the socket. It is executed using testrun.sh found in
the repo. I have also completed a local installation of glibc-2.20.

Tried on both fresh squeeze and jessie installations.

Was asked to post here after confirming with another user in #glibc.
Comment 14 Jiri Hruska 2015-01-29 02:43:12 UTC
That's a bug in the attached test case, though, not in glibc any more.

Line 122 should have `m = -1` instead of `m = 0`. Otherwise if the very first dup() call fails, the close loop below will still do one iteration and close somebody else's random file descriptor at fds[0].

To verify this, you can add the following before the `break` at line 158:
   if (errno == EMFILE) {
+    if (m == 0)
+      printf("Yo Dawg I herd you like bugs so I put a bug in your bug.c\n");
     break;
   } else {

When running the program now, every alleged error was preceded by this message just before, and I wasn't able to trigger the bug at all when the code was corrected as suggested above.

Marking as RESOLVED/FIXED again.
Comment 15 Rich Felker 2015-01-30 03:18:13 UTC
Can you confirm that with the bug in the testcase fixed it still detects the original bug in unfixed versions of glibc?
Comment 16 Jiri Hruska 2015-01-30 13:22:22 UTC
Sure, I can. Running the testcase against a glibc build without the fix applied still results in the crosstalk error messages as expected.
Comment 17 Andreas Schwab 2015-03-03 11:26:01 UTC
Created attachment 8161 [details]
Corrected reproducing code
Comment 18 cvs-commit@gcc.gnu.org 2015-04-07 18:02:00 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, ibm/2.16/master has been updated
       via  e9c2f97bf02666b01aa4af63c4e41355396acc3c (commit)
      from  627eabb20f2b70faa3698e2c0124094c6d51af8e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e9c2f97bf02666b01aa4af63c4e41355396acc3c

commit e9c2f97bf02666b01aa4af63c4e41355396acc3c
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog         |    6 ++++++
 NEWS              |    4 ++--
 resolv/res_send.c |    1 +
 3 files changed, 9 insertions(+), 2 deletions(-)
Comment 19 cvs-commit@gcc.gnu.org 2015-04-07 18:06:48 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, ibm/2.18/master has been updated
       via  fec49d52bbe7af00c80f014a76357f56293e42bd (commit)
       via  45af2f6fe19b8a776373cac5a2691460179aa1a3 (commit)
       via  d4deb63367247eaddcbe10b872d39ff70659eaf4 (commit)
       via  f2b605ed8882a922c403386b2af7e7a5eecbf39f (commit)
       via  d56700df46977b14e9fe54201132fed04475cd03 (commit)
       via  3ce4555d432282fcfe963cc8809163e85ee0f71c (commit)
       via  25394eff67a3119011ffa04a1986be130a6b628d (commit)
       via  bc273d38b147d67668e92a8f39dd696e28695c30 (commit)
       via  d680656b61891159d21a535f38219cf01d5edeea (commit)
       via  c616775d2c6df31786b71b4e135fba90b4a63f89 (commit)
       via  2a8396b962b8c57a2581023b62766a3ac44c3ba4 (commit)
       via  0553c6642be2cdf6bac776fac5fd50164cb28709 (commit)
       via  a244697f97107af77f26eb7e4dfc4538c7e68b27 (commit)
       via  8b43a2274a593ce91e673db1cfac6e808134bc84 (commit)
       via  ca0dd6386ed2b5c5c6ca392547628a1228432ae0 (commit)
       via  6d153c48a17487a1bd2ae47a1d6be8df28c21130 (commit)
      from  a33fd93601cae52dd1c53f92240e11b25b053e18 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fec49d52bbe7af00c80f014a76357f56293e42bd

commit fec49d52bbe7af00c80f014a76357f56293e42bd
Merge: 45af2f6 d4deb63
Author: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
Date:   Tue Apr 7 10:13:59 2015 -0300

    Merge branch release/2.18/master into ibm/2.18/master
    
    Conflicts:
    	NEWS

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=45af2f6fe19b8a776373cac5a2691460179aa1a3

commit 45af2f6fe19b8a776373cac5a2691460179aa1a3
Author: Andreas Schwab <schwab@suse.de>
Date:   Mon May 26 18:01:31 2014 +0200

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    Conflicts:
    	NEWS

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |   63 +++++++++++
 NEWS                                               |    9 +-
 malloc/malloc.c                                    |   20 ++--
 nptl/Makefile                                      |    2 +-
 nptl/sysdeps/sparc/sparc32/pthread_spin_lock.S     |    4 +-
 nptl/sysdeps/sparc/sparc64/pthread_spin_lock.S     |    4 +-
 nptl/tst-spin4.c                                   |  109 ++++++++++++++++++++
 ports/ChangeLog.aarch64                            |   24 +++++
 ports/ChangeLog.alpha                              |    5 +
 ports/sysdeps/aarch64/dl-trampoline.S              |   30 +++++-
 ports/sysdeps/aarch64/fpu/fpu_control.h            |    3 +
 ports/sysdeps/aarch64/soft-fp/sfp-machine.h        |    2 +-
 ports/sysdeps/unix/sysv/linux/aarch64/clone.S      |    7 +-
 ports/sysdeps/unix/sysv/linux/alpha/rt_sigaction.S |   18 +++-
 resolv/res_send.c                                  |    1 +
 string/test-strcmp.c                               |   28 +++++
 sysdeps/sparc/sparc64/multiarch/memcpy-niagara2.S  |    1 +
 sysdeps/sparc/sparc64/strcmp.S                     |   31 ++++++
 sysdeps/unix/sysv/linux/sparc/bits/eventfd.h       |    2 +
 sysdeps/unix/sysv/linux/sparc/bits/resource.h      |   27 +++++
 sysdeps/x86/fpu/bits/mathinline.h                  |    6 +-
 sysdeps/x86_64/x32/symbol-hacks.h                  |    2 +-
 22 files changed, 366 insertions(+), 32 deletions(-)
 create mode 100644 nptl/tst-spin4.c
Comment 20 James E. King, III 2015-05-27 11:32:27 UTC
I can also confirm that we were able to reproduce this issue easily and once the patch was applied, we were not able to reproduce it easily any more.  It can show up in a core looking like https://sourceware.org/bugzilla/show_bug.cgi?id=12926 with a hang in check_pf holding a lock, and all other threads calling getaddrinfo() are blocked waiting for a reply that may never happen.
Comment 21 Florian Weimer 2015-10-22 13:50:28 UTC
If this bug randomly picks a Netlink socket (such as the one used by __check_pf), and SELinux is enabled (in permissive or enforcing mode), a kernel message "SELinux:  unrecognized netlink message type=256 for sclass=30" will be logged, or "SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=30" for newer kernel versions.
Comment 22 cvs-commit@gcc.gnu.org 2016-04-22 20:00:12 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.18/master has been updated
       via  715e7fe0322004fd2e3fed853e9be3c279f5015d (commit)
       via  04130e53ba685dd7138e3e928708e17923f795b5 (commit)
       via  c5ae7f9a3b543426cb186fb7b493f9d8458467a9 (commit)
      from  b057b4813c9f05c3cedff0c74b58c9c9d583f09f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=715e7fe0322004fd2e3fed853e9be3c279f5015d

commit 715e7fe0322004fd2e3fed853e9be3c279f5015d
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Apr 22 10:38:15 2016 -0500

    resolv: Always set *resplen2 out parameter in send_dg [BZ #19791]
    
    Since commit 44d20bca52ace85850012b0ead37b360e3ecd96e (Implement
    second fallback mode for DNS requests), there is a code path which
    returns early, before *resplen2 is initialized.  This happens if the
    name server address is immediately recognized as invalid (because of
    lack of protocol support, or if it is a broadcast address such
    255.255.255.255, or another invalid address).
    
    If this happens and *resplen2 was non-zero (which is the case if a
    previous query resulted in a failure), __libc_res_nquery would reuse
    an existing second answer buffer.  This answer has been previously
    identified as unusable (for example, it could be an NXDOMAIN
    response).  Due to the presence of a second answer, no name server
    switching will occur.  The result is a name resolution failure,
    although a successful resolution would have been possible if name
    servers have been switched and queries had proceeded along the search
    path.
    
    The above paragraph still simplifies the situation.  Before glibc
    2.23, if the second answer needed malloc, the stub resolver would
    still attempt to reuse the second answer, but this is not possible
    because __libc_res_nsearch has freed it, after the unsuccessful call
    to __libc_res_nquerydomain, and set the buffer pointer to NULL.  This
    eventually leads to an assertion failure in __libc_res_nquery:
    
    	/* Make sure both hp and hp2 are defined */
    	assert((hp != NULL) && (hp2 != NULL));
    
    If assertions are disabled, the consequence is a NULL pointer
    dereference on the next line.
    
    Starting with glibc 2.23, as a result of commit
    e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca (CVE-2015-7547: getaddrinfo()
    stack-based buffer overflow (Bug 18665)), the second answer is always
    allocated with malloc.  This means that the assertion failure happens
    with small responses as well because there is no buffer to reuse, as
    soon as there is a name resolution failure which triggers a search for
    an answer along the search path.
    
    This commit addresses the issue by ensuring that *resplen2 is
    initialized before the send_dg function returns.
    
    This commit also addresses a bug where an invalid second reply is
    incorrectly returned as a valid to the caller.
    
    (cherry picked from commit b66d837bb5398795c6b0f651bd5a5d66091d8577)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=04130e53ba685dd7138e3e928708e17923f795b5

commit 04130e53ba685dd7138e3e928708e17923f795b5
Author: Andreas Schwab <schwab@suse.de>
Date:   Fri Apr 22 10:35:41 2016 -0500

    Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
    
    (cherry picked from commit 45af2f6fe19b8a776373cac5a2691460179aa1a3)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c5ae7f9a3b543426cb186fb7b493f9d8458467a9

commit c5ae7f9a3b543426cb186fb7b493f9d8458467a9
Author: Carlos O'Donell <carlos@systemhalted.org>
Date:   Tue Apr 19 17:38:09 2016 -0500

    CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug 18665).
    
    * A stack-based buffer overflow was found in libresolv when invoked from
      libnss_dns, allowing specially crafted DNS responses to seize control
      of execution flow in the DNS client.  The buffer overflow occurs in
      the functions send_dg (send datagram) and send_vc (send TCP) for the
      NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
      family.  The use of AF_UNSPEC triggers the low-level resolver code to
      send out two parallel queries for A and AAAA.  A mismanagement of the
      buffers used for those queries could result in the response of a query
      writing beyond the alloca allocated buffer created by
      _nss_dns_gethostbyname4_r.  Buffer management is simplified to remove
      the overflow.  Thanks to the Google Security Team and Red Hat for
      reporting the security impact of this issue, and Robert Holiday of
      Ciena for reporting the related bug 18665. (CVE-2015-7547)
    
    See also:
    https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
    https://sourceware.org/ml/libc-alpha/2016-02/msg00418.html
    
    (cherry picked from commit e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                 |   30 ++++
 NEWS                      |   19 +++-
 resolv/nss_dns/dns-host.c |  111 +++++++++++++++-
 resolv/res_query.c        |    3 +
 resolv/res_send.c         |  326 +++++++++++++++++++++++++++++++++------------
 5 files changed, 401 insertions(+), 88 deletions(-)